triage-ready

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill retrieves issue data from the Forge kernel which may contain untrusted user-generated content. While this creates a potential surface for instructions to influence the agent, the risk is minimized by the skill's restricted environment and its focus on derived read models.
  • Ingestion points: Issue details such as titles, dependencies, and descriptions are ingested through forge issue ready and forge issue show commands in SKILL.md.
  • Boundary markers: The skill does not currently use specific delimiters to partition untrusted issue content from the agent's reasoning instructions.
  • Capability inventory: Capabilities are limited to the Read tool and Bash(forge:*), preventing common exfiltration or destruction vectors. The skill is also explicitly defined as strictly read-only.
  • Sanitization: The procedure does not describe specific sanitization or filtering logic for the data returned by the Forge CLI.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 10:07 AM
Security Audit — agent-trust-hub — triage-ready