tb-update-task-status
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local script
bin/tb-api.mjsusing theBashtool to interact with the Teambition API. Subcommands includeget-project-tasks,get-taskflow-statuses, andupdate-task-status. - [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes untrusted data from an external API.
- Ingestion points: Task and status lists fetched via
node bin/tb-api.mjscommands. - Boundary markers: The instructions do not define delimiters or warnings to ignore instructions embedded within the API output.
- Capability inventory: The skill possesses capabilities to execute shell commands (
Bash(node *)), read files, and edit files. - Sanitization: No sanitization logic is described for the data retrieved from external API calls before it is processed by the agent.
Audit Metadata