tasks-generator
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs several shell operations to manage the repository state.
- It executes Git commands including
git fetch,git pull --rebase, andgit pushto synchronize changes with the remote repository. - It attempts to execute a local Python script
python3 scripts/update_readme_ideas_index.pyif the project is identified as an 'ideas repo'. - [DATA_EXPOSURE]: The skill reads from specific configuration files in the user's home directory to determine project paths.
- Evidence: Accesses
~/.config/ideas-root.txtand~/.openclaw/ideas-root.txtduring the input resolution phase inSKILL.md. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data which could contain malicious instructions.
- Ingestion points: Reads content from
prd.md,tad.md,ux_design.md, andbrand_kit.md(documented inagents/requirements-extractor.md). - Boundary markers: The instructions do not specify explicit delimiters or 'ignore' instructions for the sub-agents when parsing these files.
- Capability inventory: The agent can write files (
tasks.md), execute local Python scripts, and push changes to a Git repository (SKILL.md). - Sanitization: No explicit sanitization or validation of the input markdown content is performed before processing.
Audit Metadata