sprint-planning

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied backlog items, epics, and team availability data to generate sprint goals and plan deliverables. This external data is later used to perform actions in project management trackers.
  • Ingestion points: Backlog items and epic descriptions (Required Inputs in SKILL.md) and team member details (via JSON input to scripts/capacity_calculator.py).
  • Capability inventory: The skill uses scripts to write records to a brain repository and proposes ticket creation/modification in trackers via an action-runner tool.
  • Boundary markers: The skill defines clear output structures and a quality scoring rubric (Scoring Rubric in SKILL.md) to evaluate the agent's work.
  • Sanitization: The instructions do not specify sanitization or filtering for the content of user stories before they are processed by the agent.
  • [COMMAND_EXECUTION]: The skill executes local Python scripts to automate sprint calculations and data management.
  • Evidence: The SKILL.md documentation instructs the agent to run scripts/capacity_calculator.py for estimation and brain_query.py/brain_write.py for state management.
  • Context: These scripts are local components of the skill or its peer dependencies, and the capacity calculator is restricted to the Python standard library with no network access.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 05:29 PM