ideate
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill frequently executes shell commands via the
ghCLI for repository management, including creating labels (gh label create), listing issues (gh issue list), and editing issue bodies (gh issue edit). It also uses standard filesystem commands likemkdir -pandfindto manage a local scratch directory at/tmp/tunan/tunan:ideate/. - [DYNAMIC_EXECUTION]: The skill executes a Python script located at
../../scripts/repo-profile-cache.pyto handle project profile caching. This script is called withgetandputarguments to optimize orientation across sessions by reusing agnostic project facts. - [EXTERNAL_DOWNLOADS]: The
web-researchersub-agent is designed to fetch content from the open web using platform-provided search and fetch tools. While these downloads target well-known research and documentation sources, they represent the ingestion of external data at runtime. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a high attack surface for indirect prompt injection as it ingests data from Slack threads, GitHub issue trackers, and external web pages. It includes defensive instructions for its sub-agents, such as the
slack-researcherandweb-researcher, to treat all fetched content as untrusted input and to ignore any text resembling agent instructions or tool calls. - Ingestion points: GitHub issue listings and bodies (
gh issue list,gh issue view), Slack channel searches and thread reads (slack_search_public_and_private,slack_read_thread), and web search/fetch results. - Boundary markers: The skill defines a
<grounding>block and anAmbition charterto anchor agent behavior, but explicit structural delimiters for untrusted content are handled by sub-agent instruction prompts. - Capability inventory: File writing to
/tmp, shell command execution (gh,python3), and access to external networking tools (Slack MCP, Web fetch). - Sanitization: The instructions explicitly mandate the extraction of factual claims and decisions while ignoring embedded instructions in ingested data.
Audit Metadata