create-work-item-planning-skills
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is designed to generate other skills that ingest data from external sources such as GitHub, Jira, Notion, and local Markdown files. This creates a surface for Indirect Prompt Injection, where malicious content embedded in a bug report or user story could influence the agent's behavior during the planning phase. \n
- Ingestion points: External tracker APIs and local filesystem paths specified in the tracker contract. \n
- Boundary markers: The skill does not explicitly require the generation of boundary markers or instructions to ignore embedded commands within the retrieved work-item data. \n
- Capability inventory: The generated skills possess the capability to write to the filesystem (session folders) and invoke subagents via #tool:agent/runSubagent. \n
- Sanitization: The instructions mandate converting tracker content to Markdown but do not specify procedures for sanitizing or filtering instructions from the external text. \n- [DATA_EXFILTRATION]: The skill includes explicit instructions to 'preserve source metadata without copying secrets,' which serves as a mitigation against the accidental exposure of sensitive information from external trackers. \n- [COMMAND_EXECUTION]: The requirement to normalize source IDs into 'filesystem-safe session ID' strings (containing only letters, numbers, _, and -) is a security best practice that prevents path traversal and potential command injection vulnerabilities when the agent interacts with the filesystem or external APIs.
Audit Metadata