trackers-flow
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands using the GitHub CLI (
gh issue view,gh pr view) to retrieve issue and pull request data. This is standard behavior for its stated purpose. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes data from external, attacker-controllable sources (Linear issues and GitHub PRs/Issues).
- Ingestion points: Ticket titles, descriptions, and comments are fetched from Linear and GitHub as described in
SKILL.md. - Boundary markers: The 'Normalize into a ticket brief' section lacks explicit delimiters or instructions to ignore embedded commands within the fetched ticket content.
- Capability inventory: The skill utilizes
ghCLI execution and MCP tool calls for data retrieval across its logic. - Sanitization: No sanitization, escaping, or validation of the fetched external content is specified before it is incorporated into the agent's context.
Audit Metadata