cy-create-tasks
Pass
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run the
compozy validate-tasksCLI command. This is a tool provided by the skill's author used to verify the integrity of the generated task files.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes requirements from external files into the agent context.\n - Ingestion points: Reads
_prd.md,_techspec.md, and ADR markdown files from the.compozy/tasks/directory.\n - Boundary markers: None identified; the instructions do not mandate delimiters or warnings to ignore instructions within the requirement files.\n
- Capability inventory: The agent can create/modify files (
_tasks.md,task_NN.md) and execute shell commands (compozy).\n - Sanitization: No input validation or sanitization logic is described for the content of the requirements documents.
Audit Metadata