taskmaster
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the task-master-ai Node.js package globally if not already present. This package is a vendor-owned resource belonging to the skill author.
- [COMMAND_EXECUTION]: The skill executes various commands via the task-master CLI, including parse-prd, next-task, and auto-implement-tasks, which can interact with the file system and external tools.
- [PROMPT_INJECTION]: The skill processes untrusted external data in the form of Product Requirement Documents (PRDs), creating a surface for indirect prompt injection. 1. Ingestion points: PRD content provided during the parse-prd flow in SKILL.md. 2. Boundary markers: Absent; there are no delimiters or specific instructions to the agent to treat the PRD content as untrusted data. 3. Capability inventory: Includes shell command execution (task-master CLI), autonomous implementation via subagents, and network requests to localhost:3110. 4. Sanitization: Absent; no sanitization, validation, or escaping of the PRD input is performed before processing.
Audit Metadata