wayfinder
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection attacks because it ingests untrusted data from an external source.
- Ingestion points: As defined in SKILL.md, the agent reads the 'map body' and individual 'ticket' contents from a repository's issue tracker.
- Boundary markers: There are no instructions provided to the agent to treat issue content as untrusted or to use specific delimiters when processing this data.
- Capability inventory: The agent can perform significant actions based on these instructions, including invoking the /research and /prototype subagents, as well as modifying repository issues.
- Sanitization: The skill lacks any mechanism to sanitize or validate the content retrieved from the issue tracker before it is processed by the model.
- [DATA_EXFILTRATION]: The skill encourages potentially unsafe data handling practices. Specifically, in the 'Ticket Types' section of SKILL.md, it advises the agent to record 'credentials location' in the issue resolution comments. This could lead to the exposure of sensitive organizational metadata if the tracker is publicly accessible or shared with users who should not have knowledge of credential storage locations.
Audit Metadata