to-epic
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local filesystem to guide its execution.
- Ingestion points: Accesses files like .scratch/*.md, CONTEXT.md, and docs/adr/ which are likely provided by the user or external sources.
- Boundary markers: Lacks explicit markers to differentiate between instructions and data within the ingested documents.
- Capability inventory: Capable of writing multiple files and directories to the .scratch/ folder and invoking other local skills (setup-to-epic and to-backlog).
- Sanitization: Does not perform sanitization on data extracted from external documents before using it to create filesystem objects.
- Mitigation: The skill includes a 'human-in-the-loop' requirement, asking for user confirmation of the plan before performing any write operations.
Audit Metadata