dispatch-tickets
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads external ticket data (descriptions, comments, labels, and acceptance criteria) from a tracker/forge and incorporates this content into subagent prompts.
- Ingestion points: Tracker query results in the
Select Issuessection, specifically reading candidate labels, criteria, dependencies, and recent comments. - Boundary markers: The
Worker Contractsection does not utilize explicit delimiters or "ignore embedded instructions" warnings for the interpolated issue content, increasing the risk that a subagent may follow instructions placed by an attacker in an issue description. - Capability inventory: Subagents are empowered to execute repository-required checks, invoke the
/tddskill for test execution, perform git commits, push branches, and open draft PRs/MRs. - Sanitization: No explicit sanitization, validation, or filtering of the external issue content is performed before it is passed into the
Worker Contracttemplate. - [COMMAND_EXECUTION]: The skill executes local git commands (
git status,git rev-parse,git worktree) and instructs subagents to run arbitrary repository checks and tests, the nature of which is determined by the content of the issues being processed.
Audit Metadata