epic-tracker

Pass

Audited by Gen Agent Trust Hub on May 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (specifically grep and echo) to manage local git configurations in the .git/info/exclude file. It also facilitates interaction with well-known tracker services (GitHub, Linear, Jira) via their respective CLI tools (gh, linear, jira). These operations are consistent with the skill's stated purpose of managing a delivery lifecycle and coordinating with external project trackers.
  • [PROMPT_INJECTION]: The skill identifies and processes external data from local files (e.g., prd.md, brief.md) and remote tracker entities to draft project artifacts like stories and bugs. This workflow creates an indirect prompt injection surface, as content from these untrusted sources is interpolated into the agent's context. The risk is mitigated by the skill's explicit guidelines requiring user review of all drafts before saving or syncing.
Audit Metadata
Risk Level
SAFE
Analyzed
May 8, 2026, 07:04 PM