actionize
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEPERSISTENCEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PERSISTENCE]: The skill installs two system crontab entries to maintain activity outside of the agent session: a daily reminder (remind.sh) and a three-day diagnostic nudge (sync.sh and diagnose-nudge.sh).
- [DATA_EXPOSURE]: The diagnostic scripts (diagnose-nudge.sh) scan the filesystem for .env files across all registered projects to discover and extract TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data which is a common surface for indirect prompt injection.
- Ingestion points: Task names and descriptions are read from local markdown files (.plan/tasks/*.md) and the global history file (~/.plan/history.jsonl).
- Boundary markers: None. Task content is interpolated directly into tool prompts.
- Capability inventory: The skill uses InfraNodus MCP tools for clustering and gap analysis, sends messages via the Telegram Bot API, and writes to the local filesystem.
- Sanitization: None. Raw task descriptions are passed to the InfraNodus generate_topical_clusters and difference_between_texts tools.
- [COMMAND_EXECUTION]: The skill relies on extensive Bash and Python scripting to manage task state, update project configurations (CLAUDE.md, .gitignore), and interface with system utilities like crontab.
Audit Metadata