trigger-tasks

Pass

Audited by Gen Agent Trust Hub on Jul 20, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the use of the @trigger.dev/sdk and zod Node.js packages. These are standard, well-known libraries for background task management and data validation.
  • [DATA_EXFILTRATION]: Network operations are mentioned in the context of retry.fetch and task triggering. The examples use placeholder domains (e.g., api.example.com) and are consistent with the skill's purpose of managing external API interactions and workflows.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes an attack surface where tasks process external data payloads.
  • Ingestion points: Task definitions in SKILL.md and references/basic-tasks.md receive a payload object from external triggers.
  • Boundary markers: Code examples do not explicitly demonstrate the use of delimiters for untrusted payload content.
  • Capability inventory: The skill utilizes retry.fetch for network requests and tasks.trigger for spawning additional processes.
  • Sanitization: The skill promotes the use of zod for schema validation (via schemaTask), which ensures data structure integrity but does not perform semantic content sanitization for downstream LLM consumption.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 20, 2026, 04:17 PM
Security Audit — agent-trust-hub — trigger-tasks