to-tickets

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes the gh CLI to interact with GitHub repositories, performing operations like issue search, metadata retrieval, and ticket creation. This is the primary function of the skill and relies on the user's existing CLI authentication.\n- [DYNAMIC_EXECUTION]: The skill executes local Python scripts (fetch_review_context.py and set_issue_relationship.py) to manage complex API interactions. These scripts use subprocess.run with argument lists, which is a safe practice that avoids shell injection vulnerabilities.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from GitHub pull request comments and review threads. This attack surface is mitigated by explicit instructions and a human-in-the-loop process.\n
  • Ingestion points: PR comment nodes and review thread bodies fetched from the GitHub API in scripts/fetch_review_context.py.\n
  • Boundary markers: The SKILL.md instructions explicitly direct the agent to ignore non-actionable feedback and prioritize verified findings.\n
  • Capability inventory: Limited to reading repository data and creating/linking issues via the gh CLI.\n
  • Sanitization: All ticket drafts and proposed labels require explicit user approval before the publication step, preventing the automated execution of instructions hidden in processed data.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 09:18 AM
Security Audit — agent-trust-hub — to-tickets