tb-sync
Pass
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill retrieves project and task metadata from the TeamBition API and stores it in a local markdown cache file.
- Ingestion points: Data is ingested from
open.teambition.comvia thetb-api.mjsscript through various commands likeget-projectsandsearch-tags. - Boundary markers: The skill does not implement boundary markers or instructions to ignore embedded content within the generated
.teambition.cache.mdfile. - Capability inventory: The skill utilizes
Bash(node *)for API interaction andWritefor local file persistence. - Sanitization: No sanitization or validation of the API-sourced content (such as project names or task titles) is performed before it is written to the cache, creating a surface for potential indirect prompt injection if external data contains malicious instructions.
Audit Metadata