to-tickets
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it incorporates external, untrusted content into the agent's reasoning process.
- Ingestion points: The skill fetches and reads the full body and comments of issues or specifications from URLs provided as arguments in SKILL.md.
- Boundary markers: The instructions do not define explicit delimiters or warnings for the agent to ignore potentially malicious instructions embedded in the external content.
- Capability inventory: The skill has the ability to write local files in the
.scratch/directory and perform network operations to publish tickets to external trackers like GitHub or Linear. - Sanitization: There is no evidence of sanitization, escaping, or validation of the external content before it is processed or used to generate local files and tracker entries.
- [DATA_EXFILTRATION]: The skill reads local project context, including directory structures and domain glossaries, and transmits summaries to external issue tracking platforms.
- Evidence: In SKILL.md, Step 2 instructs the agent to explore the codebase, while Step 5 describes publishing the findings to "a real issue tracker (GitHub, Linear, ...)". This behavior is consistent with the skill's primary purpose but involves the transfer of project-specific metadata to external services.
Audit Metadata