work-research
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from bug reports, Azure DevOps work items, and legacy source code.
- Ingestion points: The skill reads
System.Description,System.Steps, and comments from Azure DevOps work items, as well as bug descriptions and code files provided by the user. - Boundary markers: There are no explicit instructions to use delimiters or 'ignore embedded instructions' warnings for external content.
- Capability inventory: The agent has permissions to write multiple documentation files to the project repository and use network-enabled tools such as MCP Azure DevOps and Chrome MCP.
- Sanitization: The instructions mention 'normalizing' HTML content to markdown but do not specify security-focused sanitization or filtering of external payloads.
- [DYNAMIC_EXECUTION]: The migration flow involves executing the user's local 'origin' code to capture baseline behavior for validation purposes.
- Evidence: The
references/migrate/golden-master-testing.mdfile instructs the agent to 'execute the collected scenarios, capture the real outputs of the system origin, and store them as Golden Master.' - Context: This behavior is aligned with the primary skill purpose of characterization testing during system migrations.
Audit Metadata