to-tickets
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, potentially untrusted sources such as issue bodies, comments, or URLs provided as arguments.
- Ingestion points: In
SKILL.md(Step 1), the agent is instructed to fetch and read the full body and comments of external references provided by the user. - Boundary markers: The instructions do not define clear delimiters or provided warnings to the agent to treat external content as data rather than instructions.
- Capability inventory: The agent can write files to the local filesystem (under
.scratch/) and perform network operations to publish issues to external trackers like GitHub or Linear. - Sanitization: There is no evidence of content sanitization or validation of the data retrieved from external sources before it is processed by the LLM.
Audit Metadata