work-tickets
Warn
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill is instructed to load and execute operational primitives (such as fetch, list, comment, and close) directly from the
docs/agents/issue-tracker.mdfile in the user's repository. This pattern of dynamic loading from computed paths allows the repository content to define the tool execution logic at runtime. If the repository or these specific documentation files are compromised, the agent may execute malicious commands using the user's local environment and credentials.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources and local files, creating a potential attack surface for indirect prompt injection.\n - Ingestion points: External issue tracker comments,
docs/agents/issue-tracker.md, and local specification files at.scratch/<feature>/spec.md.\n - Boundary markers: The instructions lack definitions for delimiters (such as XML tags or markdown blocks) to isolate untrusted external content from system instructions.\n
- Capability inventory: The skill possesses significant capabilities including Git write access (committing, pushing, and branch management), shell execution for running validation/tests, and network access via the tracker adapter.\n
- Sanitization: There is no mentioned sanitization, escaping, or validation of the content loaded from repository-based documentation or external trackers.\n- [COMMAND_EXECUTION]: The agent is directed to run repository-defined validation and focused tests. This involves executing arbitrary shell commands and scripts found within the project's test suite, which is an expected but inherently risky part of development automation.
Audit Metadata