backlog-capture
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection attacks because it ingests and processes untrusted data from external sources.
- Ingestion points: The skill takes 'rough text' as input, specifically mentioned to include meeting quotes, feature ideas, and customer requests (Step 1 in SKILL.md).
- Boundary markers: There are no explicit instructions or delimiters (such as XML tags or clear 'ignore instructions within data' warnings) to prevent the agent from executing commands hidden within the provided notes.
- Capability inventory: The agent is instructed to 'search the existing backlog' (file read) and 'append to backlog' (file write) in Steps 3 and 4 of SKILL.md.
- Sanitization: The instructions do not define any sanitization or validation steps for the input text before it is processed and written to the file system.
Audit Metadata