to-tickets
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of processing untrusted external content to generate task tickets.
- Ingestion points: The process defined in
SKILL.mdrequires the agent to fetch and read the full body and comments of external specifications provided via local paths or remote URLs. - Boundary markers: The instructions do not specify the use of boundary markers or delimiters to isolate untrusted external content from the system prompt, nor do they explicitly instruct the agent to ignore any embedded commands within that content.
- Capability inventory: The agent has the capability to write files to the local filesystem (in the
.scratch/directory) and perform network requests to publish issues to external platforms such as GitHub or Linear. - Sanitization: No sanitization, filtering, or validation logic is defined for the external text before it is analyzed for ticket generation.
- Human Review: The risk is effectively managed by a requirement in the 'Quiz the user' step, which mandates that the user must review and approve the breakdown before any local files are written or remote issues are published.
Audit Metadata