to-issues
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data, such as user-provided plans, specifications, and PRDs, as well as content fetched from remote issue trackers, which presents a surface for indirect prompt injection.
- Ingestion points: Ingests plan/spec/PRD content from the conversation context and fetches full bodies and comments from external issue trackers (Step 1).
- Boundary markers: Absent. The instructions do not define specific delimiters or warnings to prevent the agent from following instructions potentially embedded within the processed documents.
- Capability inventory: The agent is authorized to read local codebase files (Step 2), fetch data from remote issue trackers, and publish new content to those trackers (Step 5).
- Sanitization: Absent. The skill lacks explicit instructions for sanitizing or validating the content extracted from external documents before using it to generate new issues.
Audit Metadata