boards-my-work
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch project and work item data from Azure DevOps (dev.azure.com), which is a well-known service provider.\n- [COMMAND_EXECUTION]: The skill uses curl commands to perform REST API requests for retrieving work item information, with instructions for both Bash and PowerShell environments.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes and displays data returned from external API calls, such as work item titles and states.\n
- Ingestion points: Azure DevOps REST API responses for project listings and work item details in SKILL.md.\n
- Boundary markers: Absent; the skill does not define specific delimiters or instructions to ignore embedded content in the retrieved data.\n
- Capability inventory: Shell command execution via curl for API interactions.\n
- Sanitization: Absent; the skill does not explicitly describe sanitization of external work item fields before display.
Audit Metadata