to-goal
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple external sources, creating a surface for indirect prompt injection.
- Ingestion points: The skill reads ticket descriptions, ticket comments, external URLs, and local planning documents (e.g.,
.scratch/<feature>/spec.md). - Boundary markers: The instructions do not define clear delimiters or include warnings to ignore instructions found within the processed data.
- Capability inventory: The skill itself is restricted to read-only operations and does not have tools to write files, modify the repository, or execute shell commands.
- Sanitization: There is no evidence of sanitization, validation, or filtering of the ingested external content.
- [COMMAND_EXECUTION]: The skill requires the agent to discover validation commands from repository scripts and CI configurations.
- Context: While the skill does not execute these commands itself, it incorporates them into a goal template intended for execution by a downstream agent. This presents a risk if the discovered commands are malicious or manipulated by the external data sources mentioned above.
Audit Metadata