to-prd
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from the codebase and chat history, creating a surface for indirect prompt injection.
- Ingestion points: Reads the current conversation context and performs a codebase exploration (SKILL.md, README.md).
- Boundary markers: None identified; instructions do not specify delimiters or warnings for the agent to ignore instructions embedded within the codebase or chat history.
- Capability inventory: The skill publishes content to the project's issue tracker, which typically involves tools like the GitHub CLI (
gh) or equivalent APIs. - Sanitization: There is no explicit sanitization, validation, or escaping of the ingested content before it is published to the issue tracker.
Audit Metadata