implement-full-spec
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external sources and uses it to drive agent behavior.
- Ingestion points: Untrusted data enters the agent context via ticket descriptions and comments from ClickUp, Linear, and Jira (Phase A), as well as pull request comments and review bodies from GitHub (Phase C).
- Boundary markers: The templates provided in
references/prompt-templates.mddo not utilize protective delimiters or explicit instructions to ignore embedded commands within the ingested text. - Capability inventory: The skill has broad capabilities, including executing complex git commands (rebase, force-push), managing local worktrees, and performing GitHub API operations (commenting, resolving threads).
- Sanitization: There is no evidence of validation or sanitization of the external data before it is interpolated into instructions for the sub-agents.
Audit Metadata