erne-worker
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it processes untrusted ticket data from external providers and uses it to drive autonomous actions.
- Ingestion points: Task titles, descriptions, and acceptance criteria are fetched from ClickUp, GitHub, Linear, or Jira (SKILL.md).
- Boundary markers: The documentation does not specify the use of delimiters or 'ignore' instructions to isolate ticket content from the agent's core logic.
- Capability inventory: The skill possesses high-impact capabilities including file system modification, test execution, and pull request creation (SKILL.md).
- Sanitization: While the pipeline includes a 'Validate' step and a 'Confidence Score', these are likely internal model evaluations rather than robust sanitization against malicious instructions.
- [COMMAND_EXECUTION]: The skill facilitates the autonomous execution of the erne pipeline, which involves running shell commands, Claude Code, and test suites within a git environment.
Audit Metadata