to-tasks
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external files which serves as a potential surface for indirect prompt injection.\n
- Ingestion points: Processes
design.md, ticket files,spec.md, and build configuration files (package.json,go.mod,*.csproj) in SKILL.md.\n - Boundary markers: The instructions do not define specific delimiters for separating data from instructions in these files.\n
- Capability inventory: The skill writes new markdown files to the local file system and can push data to issue trackers (SKILL.md §6). It also proposes shell commands for task validation (SKILL.md §4).\n
- Sanitization: No automated sanitization is specified. However, the skill enforces a mandatory user approval step in section 5 ('Quiz the user') before any files are written, which allows the user to inspect and correct the generated output.
Audit Metadata