task-shepherd
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from issue trackers (titles, descriptions) and relays findings from external reviewer agents to the implementation agent.\n
- Ingestion points: Data enters the context via the initial task description or URL and subsequent JSON outputs from sub-agents recorded in the session ledger.\n
- Boundary markers: While the skill uses structured reporting and verbatim relaying, it lacks explicit safety delimiters around untrusted external content when interpolating it into sub-agent prompts.\n
- Capability inventory: The skill can spawn agents, write local files, execute a bundled Python script, and interact with git worktrees and issue trackers.\n
- Sanitization: The report generator performs JSON-safe escaping for HTML output, but the primary prompt construction logic relies on verbatim relaying without specific input filtering.\n- [COMMAND_EXECUTION]: The skill executes a bundled Python script (render_report.py) and local shell commands (e.g., git worktree) as part of its operational workflow. The script is used locally to transform the JSON ledger into a readable HTML format.\n- [DATA_EXFILTRATION]: The skill is designed to interact with external issue trackers (like GitHub or GitLab) to synchronize task status, post comments, and create follow-up issues. These network operations are core to the skill's purpose and are typically governed by user approval or specific autonomous rules for non-sensitive data.
Audit Metadata