to-tickets
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from project specifications and URLs to generate tickets, which creates a potential surface for indirect prompt injection where malicious instructions embedded in a spec could influence the agent's behavior.
- Ingestion points: The 'Gather context' section in SKILL.md describes reading from the conversation context, local specification paths, and external URLs provided by the user.
- Boundary markers: There are no explicit instructions or delimiters defined to isolate or treat external content as untrusted data.
- Capability inventory: The skill has the capability to write multiple files to the '.scratch/' directory (using the 'Local files' logic) and perform network API calls to publish issues to trackers like GitHub or Linear.
- Sanitization: No sanitization, escaping, or validation of the external content is performed before it is used to generate the titles and descriptions of tickets.
- [SAFE]: The skill uses local file storage within a scoped '.scratch/' directory and integrates with well-known issue tracking services (GitHub, Linear), which are standard development practices. The instructions prioritize user verification through the 'Quiz the user' step before any tickets are published, providing a human-in-the-loop safety checkpoint.
Audit Metadata