scan-todos
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it instructs the agent to read and classify untrusted data from source code comments.
- Ingestion points: Source code markers (TODO/FIXME/etc.) and their surrounding context are read directly from files via git grep.
- Boundary markers: There are no boundary markers or explicit instructions for the agent to ignore potentially malicious instructions embedded within the comments.
- Capability inventory: The skill allows the agent to modify files (resolving markers) and execute other tools (creating work items).
- Sanitization: No sanitization or filtering is applied to the content of the comments before processing.
- [COMMAND_EXECUTION]: The skill instructions involve dynamically building shell commands (git grep) using the user-provided
--pathargument. If this input is not properly escaped or sanitized by the platform before execution, it could lead to command injection if an attacker provides a path containing shell metacharacters.
Audit Metadata