jj-todo-workflow
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on a set of bash scripts that wrap
jj(Jujutsu) CLI commands. These scripts perform repository operations such as creating new revisions, switching the working copy, and modifying commit descriptions. - [INDIRECT_PROMPT_INJECTION]: The core workflow requires the agent to read task specifications and acceptance criteria from revision descriptions. This pattern is susceptible to indirect prompt injection if an attacker places malicious instructions in a revision's description that the agent then interprets as valid task requirements.
- Ingestion points: The
jj-todo-nextscript and the mainSKILL.mdinstructions encourage the agent to display and follow thedescriptionfield of JJ revisions. - Boundary markers: Although the skill uses
[task:flag]prefixes to track status, the actual task content is free-text Markdown, providing no clear separation between legitimate instructions and potential injection. - Capability inventory: Through the
jjtool, the agent has the ability to modify the filesystem, commit changes, and alter the repository's history. - Sanitization: The scripts print the raw content of revision descriptions to the agent's context without any validation, filtering, or escaping of the text.
Audit Metadata