to-tickets-yes
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process potentially untrusted data from external sources to generate new tickets, which could contain malicious instructions.
- Ingestion points: The agent is instructed to fetch and read the full body and comments of issues or specifications provided as arguments (SKILL.md, Step 1).
- Boundary markers: The instructions lack explicit delimiters or safety markers to help the agent distinguish between data to be processed and instructions to be ignored within the fetched content.
- Capability inventory: The agent can write files to the local
.scratch/directory and use external APIs to publish issues to trackers like GitHub or Linear (SKILL.md, Step 5). - Sanitization: There is no mention of sanitizing or validating the fetched external content before it influences the agent's output and subsequent actions.
- Reduced Oversight: The skill specifically instructs the agent to "Assume the user approves the breakdown and proceed to publish the tickets," which bypasses the standard human-in-the-loop review process and increases the risk that injected instructions could be executed.
Audit Metadata