ai-to-tickets
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external sources and possesses capabilities that could be abused if that data contains malicious instructions.
- Ingestion points: In
SKILL.mdStep 1, the agent is instructed to fetch and read the full body and comments of external references, such as issue URLs or specification paths provided in the conversation. - Boundary markers: The instructions do not define clear delimiters or "ignore instructions" warnings when the agent processes this external content.
- Capability inventory: The skill has the authority to write files to the local filesystem (including Obsidian vaults and
.scratchdirectories) and perform network operations to publish content to external trackers like GitHub or Linear (Step 5). - Sanitization: There is no explicit requirement for the agent to sanitize or filter the content retrieved from external sources before using it to generate tickets or write files.
Audit Metadata