to-tickets-yes
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it fetches and processes untrusted external data which is then used to drive actions like file creation and API calls.
- Ingestion points: The skill fetches the full body and comments of external references, such as URLs or issue trackers, as instructed in
SKILL.md(Step 1). - Boundary markers: There are no protective delimiters or instructions to treat external data as untrusted, which may lead the model to follow instructions embedded within a specification file rather than just summarizing it.
- Capability inventory: The skill has the capability to write multiple markdown files to the local
.scratch/directory and perform authenticated write operations to external trackers like GitHub or Linear. - Sanitization: The instructions lack any requirement to sanitize, filter, or validate the content retrieved from external sources before it is used to generate and publish tickets.
- [PROMPT_INJECTION]: The skill's design explicitly reduces human-in-the-loop oversight by instructing the agent to 'Assume the user approves' and proceed with publication, which increases the potential impact of an indirect injection attack.
Audit Metadata