next
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches item descriptions, acceptance criteria, and comments from external trackers (e.g., Linear) to determine work scope. It lacks boundary markers or sanitization for this untrusted data, which could lead to the agent executing malicious instructions embedded in a ticket.\n
- Ingestion points: Tracker item details and comments (SKILL.md, "Choose the item" step 3).\n
- Boundary markers: None specified for external content interpolation.\n
- Capability inventory: Subagent delegation, file writing, Git operations, PR management, and database diagnostic commands.\n
- Sanitization: None specified.\n- [DATA_EXFILTRATION]: The skill instructs the agent to perform deep database diagnostics, including inspecting
pg_stat_activityandpg_stat_statements. This capability could be abused to leak sensitive session information, query contents, or database state into public PRs or logs.\n- [COMMAND_EXECUTION]: The skill performs various shell-level operations including Git commands and worktree management as part of its automated workflow.
Audit Metadata