to-tickets
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests data from external sources and uses it to generate output and perform actions without boundary markers or sanitization.
- Ingestion points: Step 1 fetches the full body and comments from issue trackers or arbitrary URLs provided as arguments. Step 2 reads the local codebase to understand domain glossary and ADRs.
- Boundary markers: None. The instructions do not define delimiters or provide directions for the agent to ignore embedded instructions within the fetched data.
- Capability inventory: The skill can write local markdown files to the
.scratch/directory and perform network write operations by publishing issues to platforms like GitHub or Linear. - Sanitization: None. The content retrieved from external sources is interpreted directly to draft the vertical slices presented to the user.
Audit Metadata