ship-ponytail-ticket

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external issue trackers and passes it to subagents with significant system capabilities, creating a surface for indirect prompt injection.\n
  • Ingestion points: Full body, comments, and linked context of tickets are retrieved from external trackers in Section 2.1 of SKILL.md.\n
  • Boundary markers: The instructions for implementation and review subagents (Sections 3 and 4) do not employ delimiters or explicit instructions to disregard embedded commands within the fetched ticket text.\n
  • Capability inventory: The workflow involves writing code to the file system (Section 3), executing shell commands for repository test suites (Section 5), and performing network operations such as pushing code to remote branches and opening pull requests (Section 5).\n
  • Sanitization: No sanitization or validation of the fetched ticket content is performed before interpolation into subagent prompts.\n- [EXTERNAL_DOWNLOADS]: The skill directs users to install and use third-party dependencies from external repositories not identified as trusted vendors.\n
  • Evidence: Section 1 of SKILL.md provides installation instructions for github.com/DietrichGebert/ponytail and the mattpocock/skills repository.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 02:06 PM
Security Audit — agent-trust-hub — ship-ponytail-ticket