backlog-grooming
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-generated content from GUS work item fields (Details__c and Details_and_Steps_to_Reproduce__c). This content is untrusted and could contain instructions designed to influence the agent's behavior.
- Ingestion points: SKILL.md Step 3 and checks.md (Readiness section) describe reading these fields into the agent context.
- Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the ingested text.
- Capability inventory: The skill has the ability to perform writes to GUS (via gus-cli), execute git and gh shell commands, and write files to the .claude/ directory.
- Sanitization: No explicit sanitization or filtering of the work item body content is performed before processing.
- Mitigation: The impact is limited because the skill is designed to only generate proposals. The instructions explicitly mandate that all actions must be presented to the user and executed only upon explicit confirmation in Step 6.
- [COMMAND_EXECUTION]: The skill uses local shell commands to facilitate its investigation phase.
- Evidence: SKILL.md Step 4 and checks.md (Subagent prompt shape) specify the use of git blame, grep, and gh pr view to verify if code changes matching a work item have been merged into the repository.
Audit Metadata