bug-tracker-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill facilitates communication with well-known bug tracking services including Jira, Linear, GitHub, and Azure DevOps using established API protocols.
- [INDIRECT_PROMPT_INJECTION]: The skill provides functionality to ingest and process external bug data (summaries and descriptions), which constitutes an attack surface for indirect prompt injection. The skill includes specific developer guidance on sanitizing these inputs and escaping reserved characters to mitigate injection risks into underlying query languages (JQL/WIQL).
- [CREDENTIALS_UNSAFE]: The evaluation files contain placeholder tokens (e.g., 'ghp_xxxxxxxx...') used as mock data for testing logic. The skill's primary instructions correctly advocate for using environment variables for secret management, and no functional hardcoded credentials were found.
Audit Metadata