to-tickets
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data, such as project specifications and issue comments, which creates a vulnerability to indirect prompt injection.
- Ingestion points: According to
SKILL.md, the agent fetches and reads the full body and comments of spec paths or issue URLs provided in the conversation context. - Boundary markers: There are no explicit delimiters or instructions provided to the agent to disregard instructions that might be embedded within the external specifications or comments.
- Capability inventory: The agent is authorized to write local files into the
.scratch/directory and interact with external trackers like GitHub or Linear to publish tickets. - Sanitization: The skill does not include any mechanisms for sanitizing or validating the content extracted from external sources before it is used to influence the agent's output.
Audit Metadata