td-task-management
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill maintains agent memory and task state by capturing and replaying unstructured text across different context windows. This design creates a surface for indirect prompt injection where data stored in one session could influence agent behavior in a later session.
- Ingestion points: Multiple commands in SKILL.md and references/ai_agent_workflows.md (such as td log, td handoff, td create, and td reject) ingest arbitrary text descriptions, decisions, and handoff notes.
- Boundary markers: The skill instructions do not specify the use of delimiters or security warnings when displaying this stored content back to the agent through commands like td usage or td context.
- Capability inventory: The skill utilizes the td CLI tool to manage state, which is stored in a local .todos/ directory.
- Sanitization: There is no evidence in the provided files that the tool performs sanitization, validation, or escaping of the user-provided strings before they are interpolated into the agent's prompt context.
Audit Metadata