plan-create-stories
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes external, untrusted content from a Product Requirements Document (PRD) file and uses it to drive tool interactions with GitHub and Jira.
- Ingestion points: The skill reads a user-provided file at
<prd-path>to extract implementation phases and user stories. - Capability inventory: The agent uses the extracted content to execute commands via the GitHub CLI (
gh issue create) and the Atlassian MCP server for Jira ticket creation. - Sanitization: The instructions do not explicitly require sanitization or escaping of the PRD content before it is interpolated into ticket titles, descriptions, or acceptance criteria.
- Boundary markers: The skill does not define specific delimiters to isolate the untrusted PRD content from the agent's own instructions.
- Mitigation: The workflow includes a mandatory "Confirm the plan" step (Step 2) that requires the agent to display the proposed tickets to the user before creation, providing a human-in-the-loop checkpoint against malicious content.
Audit Metadata