backlog
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection during the intake phase where it reads external URLs and issue tracker content. 1. Ingestion points: External URLs and issue comments (SKILL.md). 2. Boundary markers: No explicit delimiters or instructions to ignore embedded commands are provided for these sources. 3. Capability inventory: The skill can modify local files, execute a project validation script, and perform git commits. 4. Sanitization: External content is processed without specific filtering or sanitization rules. This risk is mitigated by the requirement for explicit owner approval before any mutation is applied.
- [COMMAND_EXECUTION]: The skill uses local command execution for project maintenance. It runs a local script 'node scripts/validate-project.mjs' for project state validation and uses git commands (diff, status, commit) to manage and persist changes to the backlog files.
Audit Metadata