Productboard Automation
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from Productboard entities like notes and customer feedback, which are potential vectors for indirect instructions.
- Ingestion points: Data is retrieved through
PRODUCTBOARD_LIST_NOTES,PRODUCTBOARD_LIST_FEATURES, andPRODUCTBOARD_RETRIEVE_FEATUREinSKILL.md. - Boundary markers: No specific instructions are provided to the agent to treat retrieved content as untrusted data.
- Capability inventory: The skill allows modification of Productboard data through tools like
PRODUCTBOARD_CREATE_NOTEandPRODUCTBOARD_ADD_NOTE_TAGas defined inSKILL.md. - Sanitization: The instructions do not specify any validation or sanitization of content fetched from the Productboard API.- [EXTERNAL_DOWNLOADS]: The skill references an external MCP server for its operation.
- Evidence: Users are instructed to add the Rube MCP server using the URL
https://rube.app/mcpinSKILL.md.
Audit Metadata