to-tickets
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its handling of external data during context gathering.\n
- Ingestion points: The skill fetches external references (URLs, issue bodies, comments) as described in the context gathering step in
SKILL.md.\n - Boundary markers: No specific delimiters or safety instructions are used to separate external data from the system prompt or to instruct the agent to ignore instructions embedded in the external content.\n
- Capability inventory: The skill can read the local codebase, write to local
.scratchdirectories, and publish issues to external trackers.\n - Sanitization: There is no explicit sanitization of the fetched external data.\n- [EXTERNAL_DOWNLOADS]: The agent is instructed to fetch and read content from external URLs and issue trackers to gather context for ticket creation.\n- [DATA_EXFILTRATION]: The skill extracts information from the local codebase and conversation context and publishes it to external platforms like GitHub or Linear as part of its ticket-tracking functionality.
Audit Metadata