to-tickets
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external content from user-provided references (such as specification paths, issue descriptions, or URLs) to generate ticket titles and requirements. This creates an attack surface where malicious instructions could be embedded in those external sources to manipulate the agent's behavior or output.
- Ingestion points: The "Gather context" step (Step 1) explicitly instructs the agent to fetch and read the full body and comments of external references supplied as arguments.
- Capability inventory: The skill has the capability to perform local file-write operations in the
.scratch/directory and network-write operations to external issue trackers like GitHub and Linear. - Boundary markers: The instructions do not define specific delimiters or "ignore instructions" directives to separate the untrusted external content from the agent's system instructions.
- Sanitization: The skill lacks explicit steps for sanitizing, validating, or filtering the ingested external data before it influences the model's logic for ticket creation.
Audit Metadata