why
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and synthesize information from various external and potentially untrusted sources such as Git history, GitHub PRs, Linear tickets, Notion documents, Slack conversations, Datadog metrics, Sentry errors, and Databricks analytics.
- Ingestion points: Untrusted data is retrieved from third-party platforms via MCP tools (e.g.,
gh pr view,linear-mcp,slack-mcp) and terminal commands. - Boundary markers: The skill uses specific Markdown templates and structured prompts (e.g.,
investigator-prompt.md,synthesizer-prompt.md) to separate the user's question from retrieved data. The instructions for sub-agents emphasize providing "Direct Evidence" and "verbatim quotes" to maintain accuracy. - Capability inventory: Sub-investigators are explicitly spawned in "agent mode" (
readonly: false), which grants them the capability to execute tools. While the instructions state they "shouldn't write anything," the technical configuration allows for tool execution, which could be exploited by an indirect prompt injection (e.g., malicious instructions embedded in a PR body or Slack message) to trigger unintended tool calls. - Sanitization: No programmatic sanitization, escaping, or filtering of external content is performed before it is processed by the agent.
Audit Metadata