kata-track-progress
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Node.js scripts (
scripts/kata-lib.cjs) and shell utilities such asfind,grep, andgit. It also interacts with the GitHub CLI (gh) to retrieve pull request metadata. These operations are functional components of the project tracking workflow.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes data from project documentation and source code files. While this creates an ingestion surface for potentially untrusted content, the behavior is localized and necessary for the tool's codebase mapping and status reporting objectives.\n- [SAFE]: The skill does not perform any unauthorized data exfiltration, maintain persistence, or attempt privilege escalation. All remote interactions are directed to well-known developer services (GitHub).
Audit Metadata