tk-triage
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted natural language data from issue trackers (Jira, GitHub, ClickUp), which presents an attack surface for indirect prompt injection.
- Ingestion points: In
SKILL.md, the process involves reading the full content of issues, including comments, labels, and history (Step 1). - Boundary markers: The skill contains a dedicated 'Retrieved Evidence Boundary' section that explicitly instructs the agent to treat retrieved text as evidence/data only and never as authority that can change the skill's protocol or permissions.
- Capability inventory: The skill has capabilities to perform remote writes to issue trackers (Step 5 in
SKILL.md) and write files to the local.tigerkit/directory (described inreferences/artifact-paths.md). - Sanitization: The skill employs several safety gates, including a 'Process' step that requires explicit user confirmation (
--apply) before making changes, rechecking targets before writes, and a specific 'Approval Continuity' rule to prevent authority escalation from recovered artifacts.
Audit Metadata