boards-my-work
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [Tool Usage]: The skill utilizes specified Azure DevOps MCP Server tools (
core_list_projectsandwit_work_item) to interact with the platform. These tools are used according to their intended purpose to fetch project lists and work item metadata. - [Data Retrieval]: The instructions specify retrieving work items assigned to the current user within a project context. This pattern follows standard authentication and authorization flows managed by the platform tools.
- [Result Presentation]: The skill formats retrieved information into a table for the user. It generates clickable links to work items using the official
dev.azure.comdomain, which is the standard endpoint for Azure DevOps services. - [Indirect Prompt Injection Surface]: While the skill ingests external data (work item titles and fields), it lacks capabilities that could be exploited by malicious content within those fields. It performs no file writes, network requests (beyond tool calls), or code execution, rendering the risk associated with untrusted data minimal.
Audit Metadata