to-tickets

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/finalize_batch.py and its associated tests modify the Python system path (sys.path) at runtime to import modules from computed relative paths.
  • scripts/finalize_batch.py inserts ../ticket-autopilot/scripts and ../llm-wiki/scripts into the module search path to access shared functionality.
  • tests/test_finalize_batch.py performs similar modifications to include local script directories for testing purposes.
  • [COMMAND_EXECUTION]: The skill instructions and test suite involve executing shell commands to facilitate the ticket lifecycle and validation.
  • SKILL.md directs the agent to execute internal scripts ticket-autopilot.py and finalize_batch.py via the python3 command.
  • tests/test_finalize_batch.py uses subprocess.run to execute git and other Python scripts to set up the test environment, although these calls correctly use argument lists rather than shell strings.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external specification documents (specs) and generated ticket files, which creates an attack surface for instructions embedded in project data.
  • Ingestion Points: The agent reads project specifications as described in SKILL.md (Process step 1), and ticket files are parsed by finalize_batch.py using parse_ticket.
  • Boundary Markers: The skill utilizes a formal "Ticket Envelope" contract and canonical schemas to delimit processed data.
  • Capability Inventory: The skill has the capability to write files to the project directory, execute internal CLI tools, and trigger project-wide synchronization operations.
  • Sanitization: finalize_batch.py implements validation checks for path safety, ensuring ticket folders are within the expected docs/tickets directory, and verifies artifact graph reciprocity.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 11:38 AM