light-kanban-worker
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted task metadata including titles, descriptions, and review feedback, alongside local project documentation such as README and AGENTS.md files sourced from the provided workspace path. This creates a surface where malicious instructions embedded in the task board could influence agent behavior.
- Ingestion points: Data is ingested via Light-Kanban API endpoints (/api/tasks) and local filesystem access within the task's workspacePath.
- Boundary markers: The instructions lack specific requirements for delimiters or 'ignore' directives to isolate external task data from the agent's core instructions.
- Capability inventory: The agent retains access to its full suite of tools, including shell execution and HTTP capabilities, to perform the tasks.
- Sanitization: The skill does not define validation or sanitization protocols for external content before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill explicitly directs the agent to 'execute the task inside the project's own workflow' using the host's existing tools. While this is restricted to a single task per run, the execution logic is governed by instructions retrieved from the external Kanban board.
- [EXTERNAL_DOWNLOADS]: The skill interacts with the Light-Kanban API (defaulting to http://127.0.0.1:8641) to fetch tasks and manage agent identity. It supports external URL references for avatars and performs multipart uploads for local icon images.
Audit Metadata