taskmaster

Warn

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The task management protocol utilizes a validation_command field within CSV tracking files (e.g., TODO.csv, SUBTASKS.csv, perf_todo_template.csv) which the agent is instructed to execute to verify the completion of task steps. This mechanism allows for the execution of arbitrary shell commands based on the contents of those files.
  • [DYNAMIC_EXECUTION]: The 'Batch Task' shape uses the spawn_agents_on_csv capability, which involves assembling agent instructions at runtime by interpolating values from a CSV (such as workers-input.csv) into an instruction template defined in BATCH.md.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external artifacts (CSVs and Markdown files) that could be influenced by external sources in a project repository, leading to potential instruction override.
  • Ingestion points: TODO.csv, SUBTASKS.csv, batch/workers-input.csv, and SPEC.md are all read by the agent to determine its next actions.
  • Boundary markers: The templates and instructions do not include boundary markers or explicit guidance for the agent to ignore instructions embedded within the data fields of the CSVs.
  • Capability inventory: The skill leverages shell execution (via validation_command) and the capacity to spawn multiple autonomous sub-agents (via spawn_agents_on_csv).
  • Sanitization: No sanitization, escaping, or validation logic is provided to handle the content of the task files before they are interpolated into commands or agent prompts.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 28, 2026, 09:13 PM