ai-to-tickets
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from external sources such as remote issue trackers or specification files which could contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: The agent is instructed to fetch the full body and comments of remote issue URLs or local spec paths passed as arguments (SKILL.md, Step 1).
- Boundary markers: The instructions lack explicit boundary markers or directives for the agent to treat the fetched content as untrusted data or to ignore embedded instructions within that content.
- Capability inventory: The agent has the capability to write files to the local filesystem (under
.scratch/and Obsidian vault paths) and perform network operations to publish content to GitHub, Linear, or other issue trackers (SKILL.md, Step 5). - Sanitization: The skill does not define specific sanitization, validation, or filtering logic for external content before it is processed by the agent.
- [EXTERNAL_DOWNLOADS]: The skill fetches data from external locations to build project context.
- Evidence: Instructions explicitly state to "fetch it and read its full body and comments" if a user passes a reference like an issue number or URL (SKILL.md, Step 1).
- [COMMAND_EXECUTION]: The skill performs file system operations and remote API interactions to manage tickets.
- Evidence: The process involves writing markdown files to specific local directories and publishing issues to external platforms like GitHub or Linear (SKILL.md, Step 5). These actions are mediated by user approval in Step 4, which serves as a significant security control.
Audit Metadata