skills/raptoravis/tunan/ideate/Gen Agent Trust Hub

ideate

Pass

Audited by Gen Agent Trust Hub on Aug 31, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill frequently executes shell commands via the gh CLI for repository management, including creating labels (gh label create), listing issues (gh issue list), and editing issue bodies (gh issue edit). It also uses standard filesystem commands like mkdir -p and find to manage a local scratch directory at /tmp/tunan/tunan:ideate/.
  • [DYNAMIC_EXECUTION]: The skill executes a Python script located at ../../scripts/repo-profile-cache.py to handle project profile caching. This script is called with get and put arguments to optimize orientation across sessions by reusing agnostic project facts.
  • [EXTERNAL_DOWNLOADS]: The web-researcher sub-agent is designed to fetch content from the open web using platform-provided search and fetch tools. While these downloads target well-known research and documentation sources, they represent the ingestion of external data at runtime.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a high attack surface for indirect prompt injection as it ingests data from Slack threads, GitHub issue trackers, and external web pages. It includes defensive instructions for its sub-agents, such as the slack-researcher and web-researcher, to treat all fetched content as untrusted input and to ignore any text resembling agent instructions or tool calls.
  • Ingestion points: GitHub issue listings and bodies (gh issue list, gh issue view), Slack channel searches and thread reads (slack_search_public_and_private, slack_read_thread), and web search/fetch results.
  • Boundary markers: The skill defines a <grounding> block and an Ambition charter to anchor agent behavior, but explicit structural delimiters for untrusted content are handled by sub-agent instruction prompts.
  • Capability inventory: File writing to /tmp, shell command execution (gh, python3), and access to external networking tools (Slack MCP, Web fetch).
  • Sanitization: The instructions explicitly mandate the extraction of factual claims and decisions while ignoring embedded instructions in ingested data.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 31, 2026, 09:10 PM