ado-writeback-tracking
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the 'openpyxl' Python library, which is a standard and well-known package used for reading and writing Excel spreadsheets.
- [COMMAND_EXECUTION]: The skill executes a bundled Python script, 'scripts/tracking.py', to manage column addition and writeback operations on local files.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes data from external files into local spreadsheets.
- Ingestion points: The skill reads ticket metadata (ID, URL) from 'backlog_result.json' and row identifiers from a user-provided spreadsheet in 'scripts/tracking.py'.
- Boundary markers: No explicit boundary markers or 'ignore' instructions are present in the JSON ingestion or spreadsheet processing logic.
- Capability inventory: The script performs local file system write operations using 'openpyxl' and the 'csv' module.
- Sanitization: The script interpolates data from the ADO result file directly into spreadsheet cells without specific sanitization or validation.
Audit Metadata