triage-ready
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves issue data from the Forge kernel which may contain untrusted user-generated content. While this creates a potential surface for instructions to influence the agent, the risk is minimized by the skill's restricted environment and its focus on derived read models.
- Ingestion points: Issue details such as titles, dependencies, and descriptions are ingested through
forge issue readyandforge issue showcommands inSKILL.md. - Boundary markers: The skill does not currently use specific delimiters to partition untrusted issue content from the agent's reasoning instructions.
- Capability inventory: Capabilities are limited to the
Readtool andBash(forge:*), preventing common exfiltration or destruction vectors. The skill is also explicitly defined as strictly read-only. - Sanitization: The procedure does not describe specific sanitization or filtering logic for the data returned by the Forge CLI.
Audit Metadata