st-execute-task

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and follows instructions found in external markdown files (tasks and hooks) that may contain untrusted data.
  • Ingestion points: The agent reads implementation requirements from <task-file> and execution instructions from configuration hooks such as PRE_TASK_ASSIGNMENT.md, PRE_TASK_EXECUTION.md, and POST_ERROR_DETECTION.md located in the project root.
  • Boundary markers: The instructions do not define specific delimiters or use boundary markers to prevent the agent from following malicious commands that might be embedded within the task or hook files.
  • Capability inventory: The skill has the ability to execute local shell scripts (scripts/*.cjs), perform file system modifications (updating task status and writing noteworthy events), and deploy native agents with access to project tools.
  • Sanitization: There is no evidence of validation or sanitization performed on the content of the markdown files before they are processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 02:44 AM
Security Audit — agent-trust-hub — st-execute-task