to-tickets
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the
ghCLI to interact with GitHub repositories, performing operations like issue search, metadata retrieval, and ticket creation. This is the primary function of the skill and relies on the user's existing CLI authentication.\n- [DYNAMIC_EXECUTION]: The skill executes local Python scripts (fetch_review_context.pyandset_issue_relationship.py) to manage complex API interactions. These scripts usesubprocess.runwith argument lists, which is a safe practice that avoids shell injection vulnerabilities.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from GitHub pull request comments and review threads. This attack surface is mitigated by explicit instructions and a human-in-the-loop process.\n - Ingestion points: PR comment nodes and review thread bodies fetched from the GitHub API in
scripts/fetch_review_context.py.\n - Boundary markers: The
SKILL.mdinstructions explicitly direct the agent to ignore non-actionable feedback and prioritize verified findings.\n - Capability inventory: Limited to reading repository data and creating/linking issues via the
ghCLI.\n - Sanitization: All ticket drafts and proposed labels require explicit user approval before the publication step, preventing the automated execution of instructions hidden in processed data.
Audit Metadata