roadmap-review
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from external sources such as GitHub issues, pull request descriptions, and project documentation, which creates a surface for potential indirect prompt injection attacks.
- Ingestion points: The 'Evidence contract' section in SKILL.md specifies pulling current issues, merged PR history, and project direction documents into the agent's context.
- Boundary markers: The instructions do not define specific delimiters or include warnings to ignore instructions embedded within the ingested data.
- Capability inventory: The skill is capable of writing files (e.g., ROADMAP-YYMMDD.md) and modifying the state of the Git repository (creating or modifying milestones, issues, and labels) through the /create-issue tool.
- Sanitization: No explicit sanitization, filtering, or validation of the external strings retrieved from the Git hosting service is mentioned in the workflow.
- Mitigation: The risk is significantly reduced by Step 8 of the workflow, which mandates explicit human confirmation of the finalized plan before any milestones or issues are created or modified.
Audit Metadata