steward
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, specifically Linear tickets, human comments, and relay reports from other agents, to coordinate its project management loop. This establishes a surface where malicious instructions embedded in tickets could influence agent behavior.
- Ingestion points: Linear issue descriptions and discussion threads accessed via 'scripts/lib/linear-read-replica.sh'.
- Boundary markers: The skill lacks explicit prompt delimiters or boundary markers to isolate ingested ticket data from its internal instructions.
- Capability inventory: The skill is capable of executing local utility scripts, making API requests to vendor-controlled cloud proxies for ticket state management, and launching subsequent agent sessions.
- Sanitization: External ticket prose is processed without specific sanitization or filtering before being included in the agent's operational context.
Audit Metadata