update
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- Indirect Prompt Injection Surface: The skill processes content from potentially untrusted external sources, such as chat messages, emails, and GitHub issues.\n
- Ingestion points: Untrusted data enters the agent context from MCP-connected communication tools (chat, email) and GitHub repository data via the
ghCLI, as specified inSKILL.md.\n - Boundary markers: The instructions include a manual safeguard requiring the agent to obtain user confirmation before adding tasks or updating memory files.\n
- Capability inventory: The skill is capable of writing to local project files (
TASKS.md,glossary.md, and thememory/directory) and executing theghCLI tool.\n - Sanitization: The skill does not explicitly define sanitization or filtering procedures for the ingested external data.\n
- Self-referential processing: The skill reads from
TASKS.md, which it also updates, meaning that external data incorporated into the task list could influence the context of future updates.\n- External Command Execution: The skill interacts with the GitHub CLI (gh issue list --assignee=@me) to retrieve task information. This is an expected integration for synchronizing development-related tasks from a trusted service.
Audit Metadata