pack-shared
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions define an architecture where agents resolve execution context and specifications from external, potentially untrusted sources such as GitHub tickets, Pull Request bodies, and comments.
- Ingestion points:
execution-context.md(tickets, PRs, and comments) andreview-contract.md(specifications derived from user requests and external ticket data). - Boundary markers: The contracts do not explicitly define the use of delimiters or instructions to ignore embedded prompts when processing data from these external sources.
- Capability inventory: Agents following these contracts are granted capabilities to create or update Pull Requests (
pr-ship.md), spawn subagents for tasks (subagents.md), and interact with a browser for visual evidence (browser-evidence.md). - Sanitization: No explicit sanitization, escaping, or strict schema validation for the data ingested from external ticketing systems is specified in the contracts.
Audit Metadata