drain-tickets
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for Git worktree management using a shell command template:
git worktree add <path> -b issue-<n>-<slug>. The<slug>component, if derived from untrusted ticket titles, poses a command injection risk when interpolated into shell commands. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) by processing untrusted data from GitHub tickets.
- Ingestion points: Ticket titles and descriptions via the resolution queue resolved in SKILL.md.
- Boundary markers: Absent; there are no instructions to use delimiters or ignore instructions when passing ticket content to worker subagents.
- Capability inventory: Execution of shell commands (git) and spawning of subagents with implementation and pull request capabilities.
- Sanitization: None; the skill does not specify any filtering, escaping, or validation of ticket-derived data before it is used in prompts or shell commands.
Audit Metadata