next
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external project trackers, creating a surface for indirect prompt injection.
- Ingestion points: SKILL.md (under 'Choose the item', step 3) specifies fetching and reading item statuses, descriptions, acceptance criteria, dependencies, and recent comments from the tracker.
- Boundary markers: The instructions in SKILL.md and agents/openai.yaml lack specific delimiters or directives to treat data from the tracker as untrusted or to ignore instructions embedded within those fields.
- Capability inventory: The agent possesses extensive capabilities defined in SKILL.md, including modifying source code, pushing to remote repositories, managing Pull Requests, and deleting git branches and worktrees.
- Sanitization: No sanitization or validation logic is described for the content retrieved from external trackers before it influences the agent's reasoning or implementation phases.
- [COMMAND_EXECUTION]: The skill automates repository management and implementation tasks using shell-level operations and tool invocations.
- Evidence: SKILL.md describes workflows for branch cleanup, worktree removal (git worktree), and PR lifecycle management. It also calls upon external skills such as 'plimsoll', 'linear', and 'implement' to perform technical tasks.
Audit Metadata