asana-automate
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: Static analysis identified instruction-override phrases in
references/failure-modes.md. These were found to be educational examples used to describe security risks (e.g., how a malicious task description might look) rather than active injection attempts. - [PROMPT_INJECTION]: The skill inherently processes untrusted data from Asana (tasks, comments), which is a documented surface for indirect prompt injection.
- Ingestion points: Untrusted data enters the agent context via tool outputs in
protocols/task-detail.mdandprotocols/task-list.md(e.g., task names and notes). - Boundary markers: The author proactively addresses this in the documentation, recommending that the agent treat external content as untrusted input.
- Capability inventory: The skill only utilizes read-only tool calls to the Asana API.
- Sanitization: The documentation advises the agent to use sanitization and quoting when processing Asana content to prevent influence on downstream logic.
- [DATA_EXFILTRATION]: The skill connects exclusively to official Asana endpoints at
mcp.asana.com. This is a well-known service necessary for the skill's primary function and does not constitute unauthorized data movement. - [EXTERNAL_DOWNLOADS]: Interaction is conducted through the official Asana MCP V2 infrastructure. This is a trusted resource and does not trigger security concerns.
- [COMMAND_EXECUTION]: No unauthorized shell commands or subprocess patterns were detected. All activity is mediated through structured, predefined MCP tools.
- [REMOTE_CODE_EXECUTION]: The skill does not download or execute remote code, nor does it include any unverified package dependencies.
Audit Metadata