to-tickets
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill ingests and processes untrusted data from external sources, creating a surface for indirect prompt injection.
- Ingestion points: The skill fetches full bodies and comments from user-provided references, including spec paths, issue numbers, or URLs (SKILL.md).
- Boundary markers: There are no instructions providing boundary markers or explicit directions for the agent to ignore instructions contained within the fetched content.
- Capability inventory: The agent has the ability to read the codebase, write to the local filesystem (under .scratch/), and interact with external tracker APIs to create issues.
- Sanitization: There is no evidence of filtering or sanitization of the external content before it is processed into tickets.
- [EXTERNAL_DOWNLOADS]: The skill retrieves data from external URLs or issue trackers to gather project context. These operations target user-provided sources and well-known services.
- [DATA_EXFILTRATION]: As part of its primary function, the skill transmits project plans and context to external issue trackers such as GitHub and Linear.
Audit Metadata