todo
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes and presents arbitrary text from external todo trackers to the AI agent, creating a surface for indirect prompt injection.\n
- Ingestion points: Markdown files processed by
scripts/todos.py, and issues fetched from GitHub or Linear APIs.\n - Boundary markers: The skill uses markdown frontmatter and checklist syntax in local files, but lacks explicit instructions for the agent to ignore embedded commands within the todo body content.\n
- Capability inventory: The skill possesses filesystem write capabilities via
scripts/todos.pyand can interact with external services via CLI tools and integrations.\n - Sanitization:
scripts/todos.pyusesjson.dumpsfor todo titles in frontmatter, but does not sanitize or escape the body content of the todos.\n- [COMMAND_EXECUTION]: The skill executes local scripts and external CLI tools to perform its tasks.\n - Evidence: The skill instructions involve invoking
uv run scripts/skillsrc.py,uv run scripts/todos.py, and the GitHub CLI (gh) to manage project configuration and synchronize todo items.
Audit Metadata