analyze
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of processing untrusted external data.
- Ingestion points: As described in SKILL.md and doctrine.md, the skill retrieves "live repository, ticket, PR, and diff facts" from external sources.
- Boundary markers: The instructions lack specific delimiters or "ignore" directives to prevent the agent from following instructions embedded within the ingested repository data.
- Capability inventory: The skill has the capability to parallelize research by spawning "Task workers" (subagents) and can initiate downstream actions by "promoting" results to other skills like /task or /write-ticket.
- Sanitization: There are no mentioned mechanisms for sanitizing, escaping, or validating the content retrieved from external trackers or repositories before it is processed by the agent.
Audit Metadata