group-items-to-milestone
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external backlog items and uses it to populate GitHub issues and influence agent workflow.
- Ingestion points: Backlog item data is retrieved using the
mcp__plugin_dh_backlog__backlog_listtool (Step 2). - Boundary markers: None. The skill does not use specific delimiters or warnings to prevent the agent from following instructions embedded within backlog titles or descriptions.
- Capability inventory: The skill can execute shell commands via
uv run, update local backlog files, and perform network operations via the GitHub API to create issues and update project statuses. - Sanitization: None. Data from
{title}and{story body}is interpolated directly into commands and issue content. - [COMMAND_EXECUTION]: The skill executes local Python scripts using
uv runwith arguments derived from potentially untrusted backlog content. - Evidence: The workflow in Step 4, 5, and 6 uses
uv run .claude/skills/gh/scripts/github_project_setup.pyto create issues and update status, interpolating variables like{title}and{story body}directly into the shell command string.
Audit Metadata