backlog-manager
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from external sources and provides capabilities to modify state based on that data.
- Ingestion points: The skill fetches data from GitHub and Linear including issue titles, bodies, and comments (Step 4), linked pull requests (Step 5), and scans repository documentation files such as README.md, AGENTS.md, and CLAUDE.md for quality drift (Step 1, Step 6).
- Boundary markers: There are no instructions in the skill defining boundary markers or explicit delimiters to prevent the agent from following instructions embedded within the ingested issue content.
- Capability inventory: The agent uses the
ghCLI to label issues, post comments, close issues, and manage project items. It also interfaces with Linear to perform similar mutations. - Sanitization: The instructions do not specify any validation, filtering, or escaping of the content ingested from the tracker or repository files before it influences agent actions.
- [COMMAND_EXECUTION]: The skill relies on the
gh(GitHub) CLI to perform project management and issue tracking operations. - Evidence: The documentation provides examples of
ghcommands used for listing, editing, and commenting on issues, as well as managing GitHub Projects (e.g.,gh issue edit,gh project item-edit). - [EXTERNAL_DOWNLOADS]: The skill interacts with official APIs and command-line tools for well-known services.
- Evidence: Fetches and synchronizes data with GitHub and Linear infrastructure as part of its primary backlog management function.
Audit Metadata