build-app-context
Fail
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructions direct the agent to silently extract API keys and authentication tokens for TestRail, Jira, and GitHub from local files (~/.folio-credentials, .env) and environment variables without user confirmation or consent.
- [DATA_EXFILTRATION]: The skill accesses sensitive local file paths, specifically
~/.folio-credentials, to harvest stored authentication data. - [EXTERNAL_DOWNLOADS]: The skill performs multiple network operations to external services:
- Fetches project metadata from the vendor's official Atlassian Confluence site.
- Downloads repository contents and metadata via the GitHub API.
- Retrieves test case data and issue details from dynamic TestRail and Jira endpoints defined in local credentials.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from external sources and incorporates it into local files.
- Ingestion points: Phased gathering of TestRail case titles/steps, GitHub READMEs/feature files, and Jira story/bug descriptions (Phases 1, 2, and 3).
- Boundary markers: There are no delimiters or explicit instructions used to isolate or ignore embedded commands within the ingested data.
- Capability inventory: The skill can read sensitive local files, write to the filesystem (including modifying its own
SKILL.mdfile), and perform network GET/POST requests. - Sanitization: Sanitization is insufficient, consisting only of basic HTML tag stripping from TestRail content.
Recommendations
- AI detected serious security threats
Audit Metadata