yak-shaving-triage
Pass
Audited by Gen Agent Trust Hub on Nov 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from potentially untrusted external sources, creating an attack surface for indirect prompt injection.
- Ingestion points: Data is ingested from pull request (PR) contents, issue tracker records (GitHub or local Markdown), and project-specific guidance files like
docs/agents/issue-tracker.md. - Boundary markers: The skill employs "independence gates" to control when information is read, but it lacks explicit prompt delimiters or instructions for the agent to disregard embedded commands within the ingested text.
- Capability inventory: The skill possesses the ability to read from the filesystem, search repositories, and perform "tracker mutations" (such as creating issues or adding comments) once "Tracker Write Approval" is obtained from the user.
- Sanitization: No explicit sanitization or escaping of the ingested external content is described in the workflow, although the skill does mention preserving "sanitized evidence" when reporting urgent security or data-loss findings.
Audit Metadata