analyze
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from external sources such as pull requests, tickets, and repository diffs.
- Ingestion points: As described in
doctrine.md, the skill reads ticket/PR bodies, comments, and diffs to gather evidence for analysis. - Boundary markers: The instructions tell the agent to 'normalize the ask' and 'separate researched facts', but they do not specify the use of clear delimiters or instructions to ignore embedded commands within the external data.
- Capability inventory: Although the skill itself is scoped as read-only ('Never write to Linear or GitHub'), its output is intended to be 'promoted' to other skills like
/task-with-testswhich have the capability to write code and execute tests. - Sanitization: There are no documented procedures for sanitizing or escaping the external content before it is processed by the model.
Audit Metadata