kanban
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill starts a local web server by executing a Node.js script (
server.cjs) bundled with the skill. The server is configured to listen on all network interfaces (0.0.0.0) to facilitate remote access from other devices on the local network, as explicitly described in the documentation. - [EXTERNAL_DOWNLOADS]: The skill documentation contains a reference to a GitHub issue for project tracking. GitHub is a well-known service, and this link is provided for informational purposes rather than automated code execution.
- [PROMPT_INJECTION]: The skill processes project data from a local directory, creating a surface for indirect prompt injection if those files contain malicious instructions.
- Ingestion points: Project files read from the directory specified by the
--dirargument (defaulting to./plans) inSKILL.md. - Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the skill instructions.
- Capability inventory: Shell execution of local scripts via the Bash tool and background process management.
- Sanitization: No validation or sanitization of the processed plan data is mentioned in the skill instructions.
Audit Metadata