agent-project-board-sync
Pass
Audited by Gen Agent Trust Hub on Mar 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of the GitHub CLI (
gh) and standard Git commands to manage project boards, issues, and repository state. These commands are used for initializing boards, creating project fields, and adding items. - [EXTERNAL_DOWNLOADS]: The skill invokes
npx ruv-swarmto execute board synchronization and management tasks. Theruv-swarmpackage is a tool provided by the author 'ruvnet' and is central to the skill's intended functionality. - [DATA_EXFILTRATION]: Includes functionality to send updates to a configurable webhook endpoint and distribute reports via Slack or Email. These are documented features for real-time synchronization and team communication.
- [PROMPT_INJECTION]: The skill processes untrusted data from external sources, which creates a potential surface for indirect prompt injection.
- Ingestion points: Untrusted data enters the context through
gh issue listandgh project item-listinSKILL.md. - Boundary markers: Absent; the skill does not use specific delimiters or instructions to distinguish between its own logic and ingested content.
- Capability inventory: The agent has access to powerful tools including
Bash, file system operations (Read,Write,Edit), and GitHub API management. - Sanitization: No evidence of sanitization or validation for the ingested GitHub data was found in the provided skill content.
Audit Metadata