milestone-review
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_CONTEXT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from several untrusted sources, including sprint reports, epic stories, and bug reports, to generate milestone reviews and Go/No-Go recommendations. \n
- Ingestion points: Data is read from files in
production/sprints/,production/epics/,production/sprint-status.yaml, and other project directories using Grep and Read tools. \n - Boundary markers: The skill relies on markdown headers for extraction but lacks explicit sanitization or instructions to ignore embedded commands within the ingested content. \n
- Capability inventory: The skill has access to tools such as Bash, Write, and Agent, providing a significant potential impact if the agent is tricked by malicious instructions hidden in the reports. \n
- Sanitization: No explicit sanitization or validation of the ingested file content is performed. \n- [DYNAMIC_CONTEXT_INJECTION]: The skill utilizes dynamic context injection (
!bash ...) to execute a local script (yaml-helper.sh) at load time. This is used to resolve configuration settings likereview_modeandworkflowfrom the environment automatically when the skill is loaded. \n- [COMMAND_EXECUTION]: The skill's configuration (allowed-tools) explicitly permits the use of the Bash tool to execute theyaml-helper.shscript. The inclusion of a wildcard (*) in the allowed arguments list for this script represents a potential attack surface for argument injection if user-supplied data is passed without validation.
Audit Metadata