zj-to-issues
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by ingesting untrusted content from an external issue tracker.
- Ingestion points: SKILL.md Step 1 ('Gather context') directs the agent to fetch and read the full body and comments of issues from an external tracker based on user input.
- Boundary markers: The instructions lack explicit boundary markers or warnings to disregard instructions that might be embedded within the retrieved issue data.
- Capability inventory: The skill possesses the ability to explore the local codebase (Step 2) and publish new issues to the tracker (Step 5).
- Sanitization: No sanitization, filtering, or validation is performed on the data fetched from the issue tracker before it is processed by the agent.
- Mitigation: The risk is significantly reduced by Step 4 ('Quiz the user'), which mandates that the agent present the drafted plan to the user and iterate until approval is received before any data is published.
Audit Metadata