ziw-triage
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local automation scripts (
tick-snapshot.mjs,tick-plan.mjs,linear-dag-start.mjs) using Node.js to process project backlog data. - [COMMAND_EXECUTION]: Employs the
rg(ripgrep) utility to perform bounded filename searches within the repository to identify missing file locations associated with issues. - [INDIRECT_PROMPT_INJECTION]: The skill interacts with external data from issue trackers and pull requests which could contain malicious instructions.
- Ingestion points: Issue tracker metadata, ticket bodies, comments, and pull request logs.
- Boundary markers: The instructions explicitly mandate that external content (tracker, PR, comments, logs) must be treated as untrusted evidence and cannot override the skill's primary instructions or user configuration.
- Capability inventory: Capabilities include local script execution via Node.js, file system discovery via ripgrep, and issue tracker mutations via MCP tools.
- Sanitization: Relies on instructional constraints and trust boundary definitions rather than programmatic sanitization of the retrieved data.
Audit Metadata