factory-queue
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from an external issue tracker and local project artifacts, creating a vulnerability surface for indirect prompt injection.
- Ingestion points: Candidate briefs fetched from the external tracker (issues labeled
intent) and local artifacts such asdocs/adlc/product/PRD.mdanddocs/adlc/architect/AD.mdas described in SKILL.md. - Boundary markers: The skill uses structured comments with specific markers (
<!-- factory-queue:triage:proposal -->) to identify its own output, but it does not specify the use of prompt-level delimiters or instructions to ignore commands potentially embedded within the ingested external issue briefs. - Capability inventory: The skill is capable of performing mutations on the external tracker (labeling, lifecycle transitions, and pushing milestones/epics) and writing to local storage (creating
docs/adlc/product/roadmap.md). - Sanitization: No technical sanitization of external input is mentioned; however, the skill mandates a human-in-the-loop "Intent Gate" and "Dry-Run Gating" for all tracker write operations, which serves as a manual oversight mechanism.
Audit Metadata