backlog-as-code
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and manipulate an external markdown file (
docs/BACKLOG.md). This creates a potential attack surface where instructions hidden within the backlog data could be processed as commands by the agent. - Ingestion points: Content is read from
docs/BACKLOG.mdvia the/backlog-listand/backlog-updatesub-flows. - Boundary markers: The skill does not define any delimiters or provide instructions for the agent to ignore embedded commands within the ingested file content.
- Capability inventory: The skill possesses the capability to write and modify files on the local filesystem (
docs/BACKLOG.md). - Sanitization: The provided instructions do not include any logic for validating, escaping, or filtering the data retrieved from the backlog file before it is used in the agent's context.
Audit Metadata