task-master-install
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Fetches and executes the Node Version Manager (NVM) installation script from the well-known nvm-sh GitHub repository to manage Node.js environments.
- [EXTERNAL_DOWNLOADS]: Installs the 'task-master-ai' utility and its dependencies from the public npm registry.
- [COMMAND_EXECUTION]: Performs several system-level operations including global package installation, directory initialization, and configuration of AI coding assistant rules.
- [COMMAND_EXECUTION]: Utilizes Docker to deploy the 'datalayer/jupyter-mcp-server' image, facilitating interactive data analysis through MCP tools.
- [COMMAND_EXECUTION]: Provides troubleshooting instructions that involve system package managers (apt, yum, winget, brew) and elevated privileges (sudo) to resolve environment issues.
- [PROMPT_INJECTION]: Supports parsing of Product Requirement Documents (PRDs) and project specifications, which introduces a surface for indirect prompt injection.
- Ingestion points: Processes external PRD files and developer-provided project descriptions specified in the 'init' command.
- Boundary markers: No specific delimiters or safety instructions for handling untrusted PRD content are identified.
- Capability inventory: Executes shell commands for project management and creates configuration/rule files in the '.taskmaster/' and AI assistant directories.
- Sanitization: The instructions do not specify validation or sanitization routines for the content of processed PRDs.
Audit Metadata