tixmd-next
Warn
Audited by Gen Agent Trust Hub on Mar 22, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
@tixmd/clitool usingpnpx. This allows for the dynamic execution of external code from the npm registry at runtime.\n- [EXTERNAL_DOWNLOADS]: The skill downloads and runs the@tixmd/clipackage, which is an external dependency not included in the skill's source.\n- [PROMPT_INJECTION]: The skill reads instructions and criteria from.tixmd/project.mdand.tixmd/tixs/*.mdto guide its code implementation tasks. This creates a surface for indirect prompt injection, as the agent may follow malicious instructions embedded in these files.\n - Ingestion points: Reads files
.tixmd/project.mdand.tixmd/tixs/*.md(SKILL.md).\n - Boundary markers: Absent; there are no instructions to the agent to ignore or delimit embedded commands within the ticket data.\n
- Capability inventory: The agent can implement code changes, modify files on disk, and execute CLI tools.\n
- Sanitization: No sanitization or verification of ticket criteria is performed before the agent begins work.
Audit Metadata