plan
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple sources which can contain malicious instructions.
- Ingestion points: In SKILL.md (Project context section), sub-skills/spec.md, and sub-skills/tickets.md, the agent is instructed to read project documentation, agent instructions, and the full content (including comments) of issues from external trackers like GitHub or Linear.
- Boundary markers: There are no instructions to wrap this external content in delimiters or to apply specific warnings to the model to ignore any instructions found within the ingested material.
- Capability inventory: The skill has the ability to write files to the local repository (docs/plans/ and customized ticket directories), publish issues to external platforms, and hand off context to other agents with execution capabilities (such as prototype and implement).
- Sanitization: No sanitization or validation logic is present to filter potentially malicious prompt injection strings contained within the documentation or tracker comments before they are processed.
Audit Metadata