Azure DevOps Boards
Pass
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides documentation for using the
Bashtool to execute Azure DevOps CLI (az devops) commands andcurlfor interacting with the REST API. This is the primary intended function of the skill for project management automation. - [CREDENTIALS_UNSAFE]: No hardcoded secrets were found. Code and script examples correctly reference environment variables (e.g.,
$ADO_PAT) for handling Personal Access Tokens. - [INDIRECT_PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection as it facilitates reading work item titles, descriptions, and comments which are untrusted external inputs.
- Ingestion points: Work item fields (Title, Description, History) fetched via
_apis/wit/workitemsas documented inreferences/work-items-boards.md. - Boundary markers: None; the skill does not instruct the agent to use specific delimiters when processing work item content.
- Capability inventory: The skill allows
Bashexecution and fileWrite/Editoperations. - Sanitization: No sanitization or validation logic for the retrieved work item data is described in the reference material.
Audit Metadata