to-tickets
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface because it processes untrusted data from external sources.
- Ingestion points: The skill fetches issue bodies and comments from external trackers or reads from local specification files (SKILL.md).
- Boundary markers: No explicit delimiters are used to wrap or isolate the fetched content within the agent's context.
- Capability inventory: The skill is capable of writing markdown files to the local .scratch/ directory and publishing issues to external trackers like GitHub or Linear (SKILL.md).
- Sanitization: No automated validation or sanitization of the external content is mentioned.
- Risk mitigation: The process requires an explicit human review and approval step (Step 4) before any tickets are finalized, ensuring the user can catch and block any malicious instructions embedded in the input data.
Audit Metadata