Skip to content
skillsafebeta
← Report library
Purpose / Other

To Tickets Skill Security Audit

What the author says it does (original text)

Break a plan, spec, or the current conversation into a set of tracer-bullet tickets, each declaring its blocking edges, published to the configured tracker (edges as text in one file per ticket locally, or native blocking links on a real tracker).

Independent security check

Security risks found

Files checked
2
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The default agent-ready label and “work the frontier” instruction may start implementation without separate authorization

Source references: 3
What we found

The stated purpose is to split and publish tickets, yet real-tracker publication adds `ready-for-agent` by default, calls the tickets agent-grabbable, and then directs the agent to “work” tickets whose blockers are complete. Approval of a breakdown does not necessarily authorize implementing it.

Why this matters

If tracker automation watches that label, or the executing agent interprets “work the frontier” as implementation, publication could immediately lead to code changes, external actions, or compute costs when the user only intended to create tickets.

What this evidence establishes

The source does default to a `ready-for-agent` label and says the tickets are agent-grabbable, which could indirectly trigger implementation if the configured tracker has external automation watching that label. However, no such automation is defined here, and the Skill does not explicitly command itself to implement tickets. “Work the frontier” appears inside the publishing section and may only describe dependency order. Before approving publication, users can require omission of the label and confirm that authorization covers ticket creation only.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:58In the instructionsOpen original file
### 5. Publish the tickets to the configured trackerPublish the approved tickets. **How** depends on the tracker `/setup-matt-pocock-skills` configured; the tickets are the same either way, only the shape of the blocking edges changes:
Show 2 other places
SKILL.md:63In the instructionsOpen original file
- **Local files** → write one file per ticket under `.scratch/<feature-slug>/issues/<NN>-<slug>.md`, numbered from `01` in dependency order (blockers first). Each file's "Blocked by" lists the numbers/titles it depends on. Use the per-ticket file template below: one ticket per file, never a single combined file.- **A real issue tracker (GitHub, Linear, …)** → publish one issue per ticket in dependency order (blockers first) so each ticket's blocking edges can reference real identifiers. Use the platform's native blocking / sub-issue relationship where it has one; otherwise set each ticket's "Blocked by" to the blocking issues. Apply the `ready-for-agent` triage label unless instructed otherwise; the tickets are agent-grabbable by construction.Work the **frontier**: any ticket whose blockers are all done. For a purely linear chain that means top to bottom.
SKILL.md:67In the instructionsOpen original file
Do NOT close or modify any parent issue.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

External issue bodies and comments enter context without an untrusted-content boundary

Source references: 2
What we found

The Skill requires fetching and reading the full body and comments of a referenced issue, but never says that commands, prompts, or tool instructions inside them must be treated only as data. Other tracker users may be able to author those comments.

Why this matters

If the agent mistakes a malicious comment for Skill instructions, it could distort the ticket breakdown, induce extra actions, or publish attacker-chosen content. User approval reduces this risk, but disguised changes may still enter the proposal.

If a referenced issue or comment contains malicious prompt text, the Skill directs the agent to fetch and read it in full; that content may be controlled by other tracker users. This step does not explicitly require treating the body and comments only as untrusted data, so embedded fake instructions could influence later ticketing or publishing decisions. Users can ask the author to require instruction isolation, ignore commands in fetched content, and restrict which comments are read.

SKILL.md:17In the instructionsOpen original file
Work from whatever is already in the conversation context. If the user passes a reference (a spec path, an issue number or URL) as an argument, fetch it and read its full body and comments.
Show 1 other places
SKILL.md:58In the instructionsOpen original file
### 5. Publish the tickets to the configured trackerPublish the approved tickets. **How** depends on the tracker `/setup-matt-pocock-skills` configured; the tickets are the same either way, only the shape of the blocking edges changes:
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

The Skill drafts vertically sliced tickets with dependency edges from the conversation, a specification, or an issue, then asks the user to confirm granularity, blocking relationships, and merges or splits before publishing.

View source
SKILL.md:44In the instructionsOpen original file
Present the proposed breakdown as a numbered list. For each ticket, show:- **Title**: short descriptive name- **Blocked by**: which other tickets (if any) must complete first- **What it delivers**: the end-to-end behaviour this ticket makes workAsk the user:- Does the granularity feel right? (too coarse / too fine)- Are the blocking edges correct: does each ticket only depend on tickets that genuinely gate it?- Should any tickets be merged or split further?Iterate until the user approves the breakdown.

The configured destination controls publication: local mode writes one file per ticket under `.scratch`, while a real tracker receives separate issues, blocking relationships, and the `ready-for-agent` label by default.

View source
SKILL.md:60In the instructionsOpen original file
Publish the approved tickets. **How** depends on the tracker `/setup-matt-pocock-skills` configured; the tickets are the same either way, only the shape of the blocking edges changes:- **Local files** → write one file per ticket under `.scratch/<feature-slug>/issues/<NN>-<slug>.md`, numbered from `01` in dependency order (blockers first). Each file's "Blocked by" lists the numbers/titles it depends on. Use the per-ticket file template below: one ticket per file, never a single combined file.- **A real issue tracker (GitHub, Linear, …)** → publish one issue per ticket in dependency order (blockers first) so each ticket's blocking edges can reference real identifiers. Use the platform's native blocking / sub-issue relationship where it has one; otherwise set each ticket's "Blocked by" to the blocking issues. Apply the `ready-for-agent` triage label unless instructed otherwise; the tickets are agent-grabbable by construction.

The Skill is configured not to allow implicit invocation, so it normally requires explicit user selection or invocation.

View source
SKILL.md:4In the instructionsOpen original file
description: Break a plan, spec, or the current conversation into a set of tracer-bullet tickets, each declaring its blocking edges, published to the configured tracker (edges as text in one file per ticket locally, or native blocking links on a real tracker).disable-model-invocation: true---
agents/openai.yaml:4In the instructionsOpen original file
  short_description: "Split a plan into tracer-bullet tickets"policy:  allow_implicit_invocation: false
Start here · InstructionsSKILL.md
to-tickets
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • agents/openai.yamlFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • agents/openai.yamlSupporting file
Lines read
112
File checksum (to compare versions)
6ed305976ed85b138502b0e2ca688ba5315d73363a3cf504198e02c201c016d3