to-tickets
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it fetches and processes data from external, untrusted sources.
- Ingestion points: According to the instructions in Step 1, the agent fetches and reads the full body and comments from user-provided references, including external URLs and issue tracker links.
- Boundary markers: There are no explicit instructions or delimiters provided to isolate this fetched content from the agent's system instructions, which could lead to the agent following malicious commands embedded in the external data.
- Capability inventory: The agent possesses capabilities to read the local codebase and write files to the
.scratch/directory, representing a significant impact surface if an injection attack succeeds. - Sanitization: The skill lacks any defined sanitization or validation mechanisms for the content retrieved from external sources before it is analyzed and acted upon.
Audit Metadata