ticket-to-code-change
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from an external issue tracker (Linear) and uses it to drive code implementation and pull request creation, which constitutes an indirect prompt injection attack surface.
- Ingestion points:
SKILL.md(Step 4) instructs the agent to build prompts using the "full ticket" and "acceptance criteria" retrieved from the external provider. - Boundary markers: There are no instructions in the setup workflow to use delimiters or specific safety markers to separate the untrusted ticket content from the agent's core instructions.
- Capability inventory: The skill grants the agent the ability to modify the local filesystem ("implement and test the request"), execute repository-specific code ("run the repository's tests"), and interact with external source control providers ("opens a pull or merge request").
- Sanitization: The workflow lacks specified sanitization, validation, or filtering steps for the content retrieved from the ticket system.
Audit Metadata