to-tickets
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/finalize_batch.pyand its associated tests modify the Python system path (sys.path) at runtime to import modules from computed relative paths. scripts/finalize_batch.pyinserts../ticket-autopilot/scriptsand../llm-wiki/scriptsinto the module search path to access shared functionality.tests/test_finalize_batch.pyperforms similar modifications to include local script directories for testing purposes.- [COMMAND_EXECUTION]: The skill instructions and test suite involve executing shell commands to facilitate the ticket lifecycle and validation.
SKILL.mddirects the agent to execute internal scriptsticket-autopilot.pyandfinalize_batch.pyvia thepython3command.tests/test_finalize_batch.pyusessubprocess.runto executegitand other Python scripts to set up the test environment, although these calls correctly use argument lists rather than shell strings.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external specification documents (specs) and generated ticket files, which creates an attack surface for instructions embedded in project data.
- Ingestion Points: The agent reads project specifications as described in
SKILL.md(Process step 1), and ticket files are parsed byfinalize_batch.pyusingparse_ticket. - Boundary Markers: The skill utilizes a formal "Ticket Envelope" contract and canonical schemas to delimit processed data.
- Capability Inventory: The skill has the capability to write files to the project directory, execute internal CLI tools, and trigger project-wide synchronization operations.
- Sanitization:
finalize_batch.pyimplements validation checks for path safety, ensuring ticket folders are within the expecteddocs/ticketsdirectory, and verifies artifact graph reciprocity.
Audit Metadata