executing-tickets-with-subagents
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes GitHub issue descriptions and comments as input for planning and implementation, which could allow malicious instructions in a ticket to influence the agent's behavior.
- Ingestion points: Reads issue body and comment history via
gh issue viewinSKILL.md. - Boundary markers: The instructions lack specific delimiters or warnings to ignore commands embedded within the fetched issue data.
- Capability inventory: The skill possesses capabilities for GitHub API writes (
gh api), Git commits, and branch pushes. - Sanitization: There is no explicit process for sanitizing or validating external issue text before it is used in subagent dispatch prompts.
- [COMMAND_EXECUTION]: The skill uses shell commands for issue management and repository operations.
- Evidence: Use of
gh issue view,gh api,git-commit, andgit pushto interact with GitHub and the local worktree. - [EXTERNAL_DOWNLOADS]: The skill fetches content from external sources as part of the ticket intake process.
- Evidence: Downloads attached images from GitHub issues for processing during Phase 0.
- [DYNAMIC_EXECUTION]: The skill generates and executes tasks dynamically through subagent orchestration.
- Evidence: The orchestrator creates dispatch prompts for implementer agents that include paths, environment variables, and verification commands generated from the initial plan.
Audit Metadata