to-done
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's Dockerfile (scripts/Dockerfile) downloads the Claude Code installation script from 'https://claude.ai/install.sh' and pipes it to bash. This is a well-known service and the action is documented as part of the setup for the implementation environment.
- [COMMAND_EXECUTION]: The loop logic (scripts/loop.mts) and implementation instructions (implementer.md) make extensive use of 'git' and 'gh' (GitHub CLI) commands to automate branch management, commits, and pull request interactions. These are necessary for the skill's stated purpose of draining a ticket queue to a PR.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources including GitHub issue bodies, local Markdown files, and PR comments. It mitigates risk by executing these implementation tasks inside fresh sandboxed Docker containers for each ticket, limiting the blast radius of any potentially malicious instructions embedded in the ticket data.
- [SAFE]: The skill implements structured secret management by requiring a '.to-done/secrets' file and explicitly providing a template. It avoids hardcoding credentials and uses isolated environments (Sandcastle/Docker) to perform agent tasks, which is a security best practice for autonomous agents.
Audit Metadata