create-bug-report
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill workflow includes the execution of a local tool called documentation-standards-validator to verify that generated bug reports comply with project standards.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied text and content from project-specific files (story and task documents) to populate bug report templates. This creates a surface for indirect prompt injection where malicious instructions in those files could influence subsequent agents that process the reports.
- Ingestion points: Contents of story documents (story.{prd}.{epic}.{story}.*.md), task documents (task.{id}.{name}.md), and the global bug registry file.
- Boundary markers: Absent; the skill performs direct string interpolation into template placeholders without specific delimiters to isolate untrusted content from the rest of the report.
- Capability inventory: The skill can perform file system operations (read, write, create directories) and invoke local CLI tools.
- Sanitization: Absent; the skill does not implement validation or escaping for the user-provided bug descriptions or reproduction steps before writing them to the file system.
Audit Metadata