decompose
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local shell script named
work-item-tracker.shto create tasks within the project. The script is located using environment variables such as${CLAUDE_PLUGIN_ROOT}and fallbacks togit rev-parse. The implementation includes defensive measures by usingmktempandcatwithin double quotes to safely pass user-provided content as literal arguments, mitigating command injection risks.
Audit Metadata