sprint-planning
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied backlog items, epics, and team availability data to generate sprint goals and plan deliverables. This external data is later used to perform actions in project management trackers.
- Ingestion points: Backlog items and epic descriptions (Required Inputs in SKILL.md) and team member details (via JSON input to scripts/capacity_calculator.py).
- Capability inventory: The skill uses scripts to write records to a brain repository and proposes ticket creation/modification in trackers via an action-runner tool.
- Boundary markers: The skill defines clear output structures and a quality scoring rubric (Scoring Rubric in SKILL.md) to evaluate the agent's work.
- Sanitization: The instructions do not specify sanitization or filtering for the content of user stories before they are processed by the agent.
- [COMMAND_EXECUTION]: The skill executes local Python scripts to automate sprint calculations and data management.
- Evidence: The SKILL.md documentation instructs the agent to run
scripts/capacity_calculator.pyfor estimation andbrain_query.py/brain_write.pyfor state management. - Context: These scripts are local components of the skill or its peer dependencies, and the capacity calculator is restricted to the Python standard library with no network access.
Audit Metadata