production-engineering-workflows
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves processing untrusted data from external sources such as natural language descriptions, project documentation, and issue tracker content (e.g., GitHub Issues, Jira). This data is used to generate implementation plans and code, which presents a surface for indirect prompt injection.\n
- Ingestion points: The skill explicitly retrieves data from issue trackers and external project documentation to populate specifications and task lists as described in
SKILL.md.\n - Boundary markers: The instructions do not define explicit delimiters or isolation instructions to prevent the agent from following malicious commands embedded in external data.\n
- Capability inventory: The skill leverages platform capabilities for shell execution (e.g.,
git,gh) and file system modifications, creating a path for exploitation if an injection occurs.\n - Sanitization: Although the skill contains high-level safety rules like 'Never commit secrets,' it lacks specific runtime sanitization or escaping mechanisms for the external data it processes.
Audit Metadata