to-tickets
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources such as URLs, issue tracker bodies, and comments to build project context, creating a surface for potential instruction injection from malicious source material.
- Ingestion points: The "Collect context" phase (Step 1) reads the full body and comments from user-provided specification paths, issue numbers, or URLs (SKILL.md).
- Boundary markers: The instructions do not specify the use of delimiters or provide warnings to the agent to ignore potentially embedded instructions within the fetched external content.
- Capability inventory: The skill possesses the ability to write multiple files to the local
.scratch/directory and post new issues to external trackers like GitHub or Linear (SKILL.md). - Sanitization: There are no defined procedures for sanitizing, escaping, or validating the external content before it is interpolated into the agent's context.
Audit Metadata