feature-context-fetch-and-reconcile
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONMETADATA_POISONINGCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external JIRA stories, which is considered untrusted input and could contain malicious instructions.
- Ingestion points: The skill reads the JIRA story from .SS_WF/{{$var[ticket_id]s}}_JIRA_OUTPUT.json (SKILL.md, Section 2).
- Boundary markers: No explicit boundary markers or instructions to ignore embedded prompts within the parsed data are defined.
- Capability inventory: The skill uses curl for network requests, interacts with OpenAPI and Figma MCP servers, and performs file system writes.
- Sanitization: The skill performs filename sanitization and ensures output is valid JSON, but it lacks semantic sanitization of the natural language content extracted from the ticket.
- [METADATA_POISONING]: The documentation and instructions contain significant contradictions regarding output file paths.
- Evidence: README.md specifies an output path of src/.feature-context/, while SKILL.md Section 3 lists root-level folders while simultaneously claiming artifacts must not be written outside the src folder. This inconsistency could lead to unintended file placement.
- [COMMAND_EXECUTION]: The skill executes curl commands using URL parameters extracted from the untrusted JIRA input. It uses the -k flag to allow insecure certificate connections, which is a security trade-off for compatibility in internal environments.
Audit Metadata