ship-ponytail-ticket
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external issue trackers and passes it to subagents with significant system capabilities, creating a surface for indirect prompt injection.\n
- Ingestion points: Full body, comments, and linked context of tickets are retrieved from external trackers in Section 2.1 of
SKILL.md.\n - Boundary markers: The instructions for implementation and review subagents (Sections 3 and 4) do not employ delimiters or explicit instructions to disregard embedded commands within the fetched ticket text.\n
- Capability inventory: The workflow involves writing code to the file system (Section 3), executing shell commands for repository test suites (Section 5), and performing network operations such as pushing code to remote branches and opening pull requests (Section 5).\n
- Sanitization: No sanitization or validation of the fetched ticket content is performed before interpolation into subagent prompts.\n- [EXTERNAL_DOWNLOADS]: The skill directs users to install and use third-party dependencies from external repositories not identified as trusted vendors.\n
- Evidence: Section 1 of
SKILL.mdprovides installation instructions forgithub.com/DietrichGebert/ponytailand themattpocock/skillsrepository.
Audit Metadata