simplified-project-management
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses a hosted MCP connector at a domain associated with the Simplified platform (apikit.simplified.com), which is consistent with its stated purpose of managing Simplified project-management data.
- [PROMPT_INJECTION]: The skill retrieves and processes external content from the Simplified platform, which serves as a potential surface for indirect prompt injection.
- Ingestion points: External data is ingested through tools like pm_getTask, api_listComments, and pm_getTaskActivity (found in SKILL.md and references/workflows.md).
- Boundary markers: No explicit use of delimiters or boundary markers is mandated when handling retrieved text content.
- Capability inventory: The skill possesses broad capabilities, including creating, modifying, and deleting tasks, boards, and statuses (pm_createTask, pm_updateTask, pm_deleteTask, pm_deleteBoard).
- Sanitization: There is no mention of sanitizing or escaping retrieved content before the agent interprets or processes it.
Audit Metadata