to-issues
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources, which could contain malicious instructions meant to influence the agent's output or behavior.
- Ingestion points: The skill fetches full bodies and comments from an external issue tracker and reads files from the codebase (SKILL.md, Step 1 and 2).
- Boundary markers: The instructions do not define boundary markers (e.g., XML tags, specific delimiters) or instructions to ignore embedded prompts within the fetched context.
- Capability inventory: The skill possesses capabilities to read from the issue tracker, read the local filesystem (codebase), and write new content (publish issues) back to the issue tracker (SKILL.md, Step 5).
- Sanitization: There is no mention of sanitization, filtering, or validation of the fetched external content before it is processed into new plan components.
Audit Metadata