task-system
Pass
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on an external CLI tool named
tasksto manage project work items. This involves executing commands that modify and read files within the repository'stasks/directory. - [PROMPT_INJECTION]: The skill instructions define a workflow where the agent reads free-form, potentially untrusted text from
tasks/inbox.mdto create structured tasks. This creates a surface for indirect prompt injection, as the agent may follow malicious instructions embedded in the inbox content during the 'promotion' process. - Ingestion points:
tasks/inbox.md(read viatasks inboxor direct file access). - Boundary markers: Absent; the instructions do not specify the use of delimiters or warnings to ignore instructions within the inbox content.
- Capability inventory: The agent uses the
tasksCLI (a tool likely provided by the vendor 'lirrensi') to perform file writes and status updates. It may also have access to other general-purpose tools provided by the environment. - Sanitization: Absent; the skill does not mention any validation or filtering of the content read from the inbox before it is processed.
Audit Metadata