todo-worker

Pass

Audited by Gen Agent Trust Hub on May 19, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its core logic of executing instructions derived from untrusted project files.
  • Ingestion points: The agent reads and processes the contents of TODO.md (at the project root) and optionally .claude/todo-worker-config.md to determine its actions.
  • Boundary markers: There are no explicit boundary markers or system instructions to ignore potential commands embedded within the TODO.md task titles or configuration files.
  • Capability inventory: Step 5 of the execution skeleton explicitly directs the agent to 'Use whichever sub-skills, scripts, or tools the title implies' and read project-provided configuration for execution mapping. This grants the agent broad discretion to utilize available tools based on external text.
  • Sanitization: The skill lacks any sanitization, filtering, or validation logic to ensure that task titles do not contain malicious instructions aimed at manipulating the agent's behavior.
Audit Metadata
Risk Level
SAFE
Analyzed
May 19, 2026, 07:37 AM
Security Audit — agent-trust-hub — todo-worker