todo-scan
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill presents an indirect prompt injection vulnerability surface because it automatically parses external, untrusted content from the repository and remote tracking systems.
- Ingestion points: Code annotations extracted via
git grepand GitHub issue/PR data fetched via theghtool inSKILL.md. - Boundary markers: Absent. The prompt does not wrap the ingested text in specific delimiters or instruct the model to treat the content purely as data rather than instructions.
- Capability inventory: The skill is limited to read-only actions (
git grep,git log,gh issue list,gh pr list). It does not contain capabilities for modifying the file system, running arbitrary commands, or exfiltrating data to non-whitelisted remote endpoints. - Sanitization: Absent. The raw comment strings and titles are supplied directly to the synthesis phase without any preprocessing or sanitization.
Audit Metadata