why
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes large volumes of unstructured, human-generated data from external sources such as Slack messages, Notion documents, PR comments, and issue tracker descriptions. This content is ingested into the agent context without explicit sanitization or boundary markers to prevent the agent from obeying instructions embedded in the historical records.
- Ingestion points: Data enters the agent context through the Slack, Notion, Linear, and Git MCP tools in the investigator subagents.
- Boundary markers: The templates for investigator and synthesizer subagents lack specific delimiters or instructions to treat external data as untrusted content.
- Capability inventory: The skill uses subagents with full agent capabilities (readonly: false) and maintains access to shell commands (git, gh, rg) and a wide range of MCP tools.
- Sanitization: There is no evidence of escaping, filtering, or validation of the content retrieved from external databases and communication tools.
- [COMMAND_EXECUTION]: The skill uses shell commands including git log, git blame, gh pr view, and rg (ripgrep) to establish a code anchor and perform archaeology. These commands are essential to the skill's functionality but involve executing shell processes based on parameters derived from the code and repository structure.
Audit Metadata