do-tickets
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill creates an indirect prompt injection surface because it instructs the agent to ingest and follow instructions stored in external ticket prompts.
- Ingestion points: Data enters the agent's context through the
sesh ticket get --id <id> --field promptcommand inSKILL.md. - Boundary markers: The instructions lack explicit delimiters or warnings to treat the retrieved ticket content as untrusted or to ignore embedded instructions that might contradict safety guidelines.
- Capability inventory: The agent is empowered to execute shell commands (
sesh), manage files (via@blobexpansion), and perform work tasks (referenced bycommit-sha) based on the content of these external tickets. - Sanitization: There is no mention of filtering or sanitizing the ticket prompt before it is delivered to or read by the agent.
Audit Metadata