ready-for-agent-check
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from GitHub tickets, which could contain malicious instructions designed to influence the agent's behavior.\n
- Ingestion points:
SKILL.md(Step 2) fetches ticket bodies and comments using theghtool.\n - Boundary markers: The
references/review.mdtemplate uses clear placeholders and provides the subagent with a strict analytical persona, explicitly warning it that the content is untrusted and that it should not attempt to fix or build the described work.\n - Capability inventory: Subagents are limited to analysis and reporting findings. The primary skill has model invocation disabled and coordinates data flow to the local management engine.\n
- Sanitization: Content is passed as-is to the analysis subagent, relying on prompt-based isolation to prevent instruction override.\n- [DYNAMIC_EXECUTION]: The
scripts/invoke.pyscript identifies and executes a local management engine (kntnt.py) by searching through a list of common AI agent skill directories in the user's home folder. This allows the skill to work across different agent harnesses where thekntnttoolset might be installed.\n- [COMMAND_EXECUTION]: The skill relies on external binariesgh(GitHub CLI) anduv(Python runner) to interact with external services and execute its internal Python logic via subprocess calls.
Audit Metadata