to-tickets
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, creating an attack surface for indirect prompt injection.
- Ingestion points: The skill explicitly gathers context by fetching external references (spec paths, issue numbers, or URLs) and reading their full body and comments (SKILL.md, Step 1). It also explores the local codebase (SKILL.md, Step 2).
- Boundary markers: The instructions do not define clear delimiters or provide the agent with "ignore embedded instructions" warnings for the ingested content, increasing the risk of the agent following malicious instructions found within external specs.
- Capability inventory: The skill has the capability to write local files to the
.scratch/directory and perform network operations to publish content to external issue trackers like GitHub or Linear (SKILL.md, Step 5). - Sanitization: There is no mention of sanitizing, escaping, or validating the external content before it is processed by the agent's logic.
Audit Metadata