action-items-todoist
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted meeting data from Granola and Grain transcripts which could contain embedded instructions to influence the agent's behavior.
- Ingestion points: Meeting summaries are fetched via
mcporter call granola query_granola_meetingsand full meeting transcripts viamcporter call grain.fetch_meeting_transcript. - Boundary markers: The skill does not use specific delimiters or "ignore embedded instructions" warnings when passing external meeting content to the model for reasoning.
- Capability inventory: The skill possesses significant capabilities including shell command execution for task management (
todoist-cli), drafting follow-up emails, and file system write access for state tracking (processed-meetings-YYYY-MM-DD.json). - Sanitization: There is no evidence of filtering or sanitizing meeting content before it is interpolated into prompts or used to generate task titles and email drafts.
Audit Metadata