scan-todos

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it instructs the agent to read and classify untrusted data from source code comments.
  • Ingestion points: Source code markers (TODO/FIXME/etc.) and their surrounding context are read directly from files via git grep.
  • Boundary markers: There are no boundary markers or explicit instructions for the agent to ignore potentially malicious instructions embedded within the comments.
  • Capability inventory: The skill allows the agent to modify files (resolving markers) and execute other tools (creating work items).
  • Sanitization: No sanitization or filtering is applied to the content of the comments before processing.
  • [COMMAND_EXECUTION]: The skill instructions involve dynamically building shell commands (git grep) using the user-provided --path argument. If this input is not properly escaped or sanitized by the platform before execution, it could lead to command injection if an attacker provides a path containing shell metacharacters.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 07:55 PM
Security Audit — agent-trust-hub — scan-todos