to-tickets

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests untrusted data from external sources to generate its output.
  • Ingestion points: Reads content from local files (./docs/plans/*.md, ./docs/prd-*.md), fetches remote GitHub issues via the gh CLI, and consumes Notion page content or in-context user conversations.
  • Boundary markers: The skill uses specific XML-like tags (e.g., <vertical-slice-rules>, <ticket-template>) to delimit instructions and templates from processed data.
  • Capability inventory: The skill can execute shell commands via gh (to view/create/edit issues), write to local configuration files (command-centre.toml, treepad manifests), and invoke external agent skills (create-adhoc-linear-issue).
  • Sanitization: A robust human-in-the-loop (HITL) mechanism is enforced. The agent must present a drafted plan and "Quiz the user" for approval before performing any ticket creation or file modification.
  • [COMMAND_EXECUTION]: The skill utilizes standard shell commands and the GitHub CLI to perform project management tasks.
  • Evidence: Employs gh issue view, gh issue create, gh issue edit, git rev-parse, and ls to interact with the repository and issue tracker for its primary functionality.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 02:11 PM