to-tickets
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection by ingesting and acting upon untrusted data from external sources.
- Ingestion points: The agent is instructed to fetch and read the full body and comments of external references, such as issue URLs or specification paths provided during the conversation.
- Boundary markers: The instructions lack explicit boundary markers or delimiters that would help the agent distinguish between legitimate task data and potentially malicious instructions embedded within the fetched external content.
- Capability inventory: The skill allows the agent to read local files, perform network requests to fetch external data, write new files to the
.scratch/directory, and interact with external project management APIs (e.g., GitHub, GitLab). - Sanitization: There are no specified sanitization or validation steps to filter the content of external references before they are used to generate ticket descriptions and requirements.
- [EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch data from external URLs or issue trackers. While this is a core functionality for gathering context, it involves retrieving content from non-whitelisted domains which could serve as a vector for malicious payloads or data gathering.
Audit Metadata