boards-query

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes curl to interface with the Azure DevOps REST API. It includes defensive programming instructions to avoid command injection, such as mandatory URL encoding for special characters like $ and the use of quoted heredocs to prevent unintended shell expansion of user-provided strings.
  • [EXTERNAL_DOWNLOADS]: The skill fetches data from official Microsoft Azure DevOps domains (dev.azure.com). These requests are used to retrieve project lists, query definitions, and work item details required for the skill's primary function.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface by reading content from external work items (titles and field values). It mitigates associated risks by treating the ingested data as passive text for tabular display rather than executable instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 04:39 AM