skills/pandoscope/skills/to-tickets/Gen Agent Trust Hub

to-tickets

Pass

Audited by Gen Agent Trust Hub on Sep 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions direct the agent to utilize the uvx disambiguate <term> command to verify vocabulary consistency against project documentation.
  • [EXTERNAL_DOWNLOADS]: The use of uvx facilitates the downloading and execution of the unversioned 'disambiguate' package from public repositories at runtime.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process potentially untrusted data from project specifications, external URLs, and conversation logs. Ingestion points: Specification file paths, issue numbers, and external URLs provided in context. Boundary markers: The instructions lack explicit delimitation or isolation protocols for untrusted content during processing. Capability inventory: The skill possesses capabilities for reading external file and URL content and publishing processed tickets to project trackers. Sanitization: The skill relies on human-in-the-loop validation, including a 'grilling gate' and 'user quiz' to review generated tickets before publication.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 2, 2026, 06:25 PM
Security Audit — agent-trust-hub — to-tickets