daily-meeting-update
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially untrusted data from GitHub commits, pull requests, and Jira tickets. If this data contains embedded instructions (e.g., within PR descriptions or commit messages), it could influence the agent's behavior during the interview process or the final update generation.
- Ingestion points: Data is pulled from the GitHub CLI (
gh), Jira CLI, and local Claude Code session history files (~/.claude/projects/) via theclaude_digest.pyscript. - Boundary markers: The skill relies on user consent and manual selection (using
AskUserQuestionToolwithmultiSelect) to filter data, which acts as a human-in-the-loop safety measure, but no programmatic sanitization of the content is defined to prevent instruction injection. - Capability inventory: The agent has the ability to execute shell commands (e.g.,
gh,jira,bash) and interact with the user, which could be abused if an injection is successful. - Sanitization: The provided Python script extracts titles and file names but does not escape or filter the content of messages or summaries for LLM-specific injection markers.
Audit Metadata