to-tickets-yes

Pass

Audited by Gen Agent Trust Hub on Jul 18, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it fetches and processes untrusted external data which is then used to drive actions like file creation and API calls.
  • Ingestion points: The skill fetches the full body and comments of external references, such as URLs or issue trackers, as instructed in SKILL.md (Step 1).
  • Boundary markers: There are no protective delimiters or instructions to treat external data as untrusted, which may lead the model to follow instructions embedded within a specification file rather than just summarizing it.
  • Capability inventory: The skill has the capability to write multiple markdown files to the local .scratch/ directory and perform authenticated write operations to external trackers like GitHub or Linear.
  • Sanitization: The instructions lack any requirement to sanitize, filter, or validate the content retrieved from external sources before it is used to generate and publish tickets.
  • [PROMPT_INJECTION]: The skill's design explicitly reduces human-in-the-loop oversight by instructing the agent to 'Assume the user approves' and proceed with publication, which increases the potential impact of an indirect injection attack.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 18, 2026, 07:24 AM
Security Audit — agent-trust-hub — to-tickets-yes