trello
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from the Trello API, including card titles and descriptions. This introduces a surface for indirect prompt injection if the Trello content is controlled by a malicious actor. * Ingestion points: API responses from api.trello.com processed in SKILL.md. * Boundary markers: None provided in the shell command templates. * Capability inventory: curl for network requests and jq for data processing. * Sanitization: None detected in the provided commands.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill interacts with the well-known Trello API service. It properly instructs users to manage authentication tokens via environment variables rather than hardcoding them, minimizing the risk of credential exposure. The use of curl commands targets official API endpoints for legitimate functionality.
Audit Metadata