task-batch
Warn
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructs the agent to suppress standard user interaction ("NO user interaction until all tasks complete") and to defer or ignore user questions ("Normal user questions: CONTINUE
- Queue for end-of-batch response"). This overrides default safety protocols that rely on user confirmation for autonomous actions.\n- [PROMPT_INJECTION]: Indirect Prompt Injection surface: The skill reads and parses untrusted external data (PRD files, task lists, and JSON configurations) to drive its autonomous execution loop.\n
- Ingestion points: Inputs such as
task-file.prq,prd-file.md, and inline task strings provided at runtime.\n - Boundary markers: Absent; there are no instructions to treat the contents of these files as untrusted or to isolate them from the command generation logic.\n
- Capability inventory: The skill has broad capabilities including
Bash,Write,Edit, and the ability to spawn subagents to execute the derived tasks.\n - Sanitization: No validation or sanitization of the parsed task content is described before it is passed to subagents for execution.\n- [COMMAND_EXECUTION]: The skill uses the
Bashtool to execute various local shell scripts (e.g.,teammate-idle-quality-gate.sh,task-completed-quality-gate.sh,action-report-generator.sh) for operational logic, quality validation, and progress reporting.\n- [EXTERNAL_DOWNLOADS]: The documentation references external third-party repositories and research sources (such as roboticforce/sugar and vasiliyk/claude-queue) as the basis for its autonomous execution patterns.
Audit Metadata