incident-to-skill-generator
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection as it ingests untrusted data from multiple external sources including Slack messages, Jira tickets, and Groundcover logs. Adversarial content embedded in these sources (e.g., in an incident description or log entry) could attempt to influence the agent's behavior.
- Ingestion points: Slack channels, Jira tickets, BigQuery results, Groundcover logs, and product documentation.
- Boundary markers: None explicitly defined to separate untrusted data from agent instructions.
- Capability inventory: File system writes to a local repository, Git commands (commit and push to origin master), and Slack message posting.
- Sanitization: The skill instructs the agent to replace incident-specific values with placeholders, but does not provide technical sanitization for potentially malicious strings within the processed data.
- [DATA_EXFILTRATION]: The core workflow involves extracting data from sensitive internal systems (BigQuery, Groundcover, Slack) and publishing a summary to a Git repository. Although the instructions mandate generalization and placeholder use, there is an inherent risk that sensitive internal information, credentials, or PII could be leaked into the Git history if the agent fails to correctly identify and redact all sensitive signals.
- [COMMAND_EXECUTION]: The skill performs automated file writes and shell-level Git operations (
git commit,git push) targeting a hardcoded local path (/Users/adityagupta/Projects/oncall-investigator-skills). This automated push capability increases the impact of any successful prompt injection or data leakage.
Audit Metadata