woostack-fix
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted input from external services including Sentry, monitoring systems, and issue trackers (GitHub, Linear, Plane), which creates a surface for indirect prompt injection attacks.\n
- Ingestion points: Untrusted data enters the agent context through the goal argument and issue references specified in the
/woostack-fixcommand (File:SKILL.md).\n - Boundary markers: The skill implements a "Context-loading boundary" and a "Fixed sequence" that requires root-cause proof before any provider or repository mutations occur, which mitigates the risk of immediate obedience to injected instructions.\n
- Capability inventory: The skill has the capability to write Markdown artifacts to the local filesystem, interact with project management APIs, and trigger downstream implementation via
woostack-execute.\n - Sanitization: While the workflow includes verification gates, it does not explicitly describe sanitization or escaping mechanisms for the untrusted text strings before they are processed by the model.\n- [EXTERNAL_DOWNLOADS]: The skill interacts with well-known services (GitHub, Linear, Plane, Sentry) to manage issue metadata and project state. These interactions are conducted through official tools such as the
ghCLI and dedicated MCP providers.
Audit Metadata