todo-worker
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its core logic of executing instructions derived from untrusted project files.
- Ingestion points: The agent reads and processes the contents of
TODO.md(at the project root) and optionally.claude/todo-worker-config.mdto determine its actions. - Boundary markers: There are no explicit boundary markers or system instructions to ignore potential commands embedded within the
TODO.mdtask titles or configuration files. - Capability inventory: Step 5 of the execution skeleton explicitly directs the agent to 'Use whichever sub-skills, scripts, or tools the title implies' and read project-provided configuration for execution mapping. This grants the agent broad discretion to utilize available tools based on external text.
- Sanitization: The skill lacks any sanitization, filtering, or validation logic to ensure that task titles do not contain malicious instructions aimed at manipulating the agent's behavior.
Audit Metadata