op-cli
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from an external OpenProject instance, which serves as a potential vector for indirect prompt injection.
- Ingestion points: Data enters the agent's context through commands such as
op-cli wp list,op-cli wp get,op-cli wp search,op-cli wp history, andop-cli wp comments, which retrieve work package details, descriptions, and user comments. - Boundary markers: The skill does not define specific delimiters or instructional guards to separate the data retrieved by the tool from the agent's system instructions.
- Capability inventory: The skill provides the agent with extensive capabilities to modify the environment, including creating, updating, and deleting work packages (
op-cli wp create/update/delete), managing time logs (op-cli time log/update/delete), and modifying project memberships (op-cli project member add/remove). - Sanitization: There is no mention of sanitizing, escaping, or validating the content retrieved from OpenProject before it is processed by the agent, allowing potentially malicious instructions embedded in work package descriptions or comments to influence agent behavior.
Audit Metadata