procrastinate
Warn
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill performs dynamic loading and execution of Python functions based on string inputs in
references/job-dispatch.mdandreferences/job_runner.py. - It utilizes
importlib.import_module(module)andgetattr(mod, job_name)to resolve and execute code at runtime. - [COMMAND_EXECUTION]: The skill provides logic to spawn subprocesses for local task execution in
references/job-dispatch.md. - The
dispatch_jobfunction usesasyncio.create_subprocess_execto run tasks as independent Python processes when configured in subprocess mode. - [COMMAND_EXECUTION]: The skill documents the use of shell pipes and environment variables for database management tasks in
SKILL.mdandreferences/schema.md. - Example provided:
procrastinate schema --print-schema | psql $DATABASE_URL. - [DATA_EXFILTRATION]: The skill reads captured command output from temporary files on the local file system in
references/job-dispatch.md. - The
get_job_historyfunction useslog_path.read_text()to retrieve data stored in the system's temporary directory during subprocess execution. - [PROMPT_INJECTION]: The design of the job dispatching mechanism presents a surface for indirect prompt injection.
- Ingestion points: Task names (
job_name) and module paths (module) are accepted as string parameters in thedispatch_jobfunction withinreferences/job-dispatch.md. - Boundary markers: No explicit boundary markers or instructions to ignore instructions embedded in the task data are implemented.
- Capability inventory: The skill possesses capabilities for subprocess execution and dynamic loading of Python modules.
- Sanitization: No sanitization, validation, or allow-listing is performed on the module or task identifiers before they are used to load and run code.
- [EXTERNAL_DOWNLOADS]: The skill includes instructions to download and install the Procrastinate library from external package registries.
SKILL.mdreferences standard installation commands likepip install procrastinateandpip install 'procrastinate[django]'.
Audit Metadata