why
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and synthesize information from untrusted external sources including GitHub Pull Request discussions, issue tracker comments, team chat history (Slack/Discord), and documentation (Notion/Confluence), which provides a surface for indirect prompt injection attacks.\n
- Ingestion points: The skill ingests external data through
git log,gh pr view, and various MCP (Model Context Protocol) servers for third-party platforms like Linear, Jira, Notion, and Slack, as detailed in Step 3 ofSKILL.mdand the template inreferences/investigator-prompt.md.\n - Boundary markers: The instructions lack explicit security delimiters or specific warnings for the agent to ignore instructions embedded within the retrieved historical records, relying instead on general epistemic discipline and reasoning tiers.\n
- Capability inventory: The skill uses the
Agenttool to spawn sub-investigators and executes shell commands throughgitandgh. These capabilities could be leveraged if an agent obeys hidden instructions in the analyzed data.\n - Sanitization: The skill does not implement sanitization or filtering of the retrieved content before it is passed to the subagents or the final synthesizer.
Audit Metadata