fleet
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources and uses it to drive the logic of subagents and automated testing.
- Ingestion points: The skill reads GitHub issue titles and bodies via
gh issue list(dispatch.md, reconcile.md), pull request diffs (land.md), and journey definitions fromdocs/prds/(reconcile.md). - Boundary markers: While the dispatch prompts use structural headers like 'Brief:' and 'Files to touch:', they lack explicit instructions for subagents to ignore instructions embedded within the ingested data.
- Capability inventory: The skill possesses high-privilege project capabilities, including Git operations, GitHub CLI access (creating PRs, editing issues), worktree management, and the ability to spawn subagents and execute journeys.
- Sanitization: The skill does not perform sanitization or validation of the content retrieved from issues or documentation before it is used in subagent prompts or journey executions.
- [COMMAND_EXECUTION]: The skill relies on shell command execution for its core orchestration logic.
- Evidence: It uses
git,gh,tp, and a specializedfleetCLI to manage the development lifecycle, branch state, and worktree environments.
Audit Metadata