to-tickets
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts and the GitHub CLI (
gh) to perform repository operations. It usessubprocess.runwith list-based arguments in its scripts, which is a safe practice that prevents shell injection vulnerabilities.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted content from pull-request review threads and other external source materials to generate ticket drafts, creating an indirect prompt injection surface.\n - Ingestion points: Pull-request review comments and threads are fetched via the
scripts/fetch_review_context.pyscript.\n - Boundary markers: The instructions do not specify explicit delimiters or markers to isolate fetched untrusted content from the rest of the prompt context.\n
- Capability inventory: The skill has the capability to create GitHub issues, apply labels, and define issue relationships (sub-issues and blockers) using the
ghtool andscripts/set_issue_relationship.py.\n - Sanitization: There is no automated sanitization of the input data; however, the skill strictly enforces a manual approval phase (Step 4) where the user must review all drafted titles and bodies before any write operations occur.
Audit Metadata