create-milestone
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied milestone titles and descriptions which are later interpolated into a shell command and stored in the repository.
- Ingestion points: User input for {title} and {description} captured in Step 1 and arguments of SKILL.md.
- Boundary markers: Absent. The instructions do not provide delimiters or warnings to the agent to treat these inputs as untrusted data.
- Capability inventory: The skill executes a local Python script using
uv runin Step 3 and interacts with the GitHub API via Backlog MCP tools. - Sanitization: Absent. No sanitization or escaping logic is specified for the user-provided variables.
- [COMMAND_EXECUTION]: The workflow in SKILL.md (Step 3) instructs the agent to construct a shell command using string interpolation of user-provided variables (
{title},{description}). This pattern creates a surface for command injection if the input contains shell metacharacters or unbalanced quotes.
Audit Metadata