track

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill interfaces with local tools and system utilities, including a custom shell script (work-item-tracker.sh), git, jq, mktemp, and date. These operations are essential for its documented purpose of development task management.
  • [COMMAND_EXECUTION]: In the add action, the instructions direct the agent to write large content bodies to temporary files and pass them to the tracker tool via command substitution (e.g., $(cat "$BODY_FILE")). This is a security-conscious approach implemented to avoid shell interpolation of complex or potentially untrusted user-supplied content.
  • [SAFE]: No patterns of prompt injection, data exfiltration, remote code execution, or persistence were detected. The skill's operations are confined to the local project environment and intended work item providers as configured by the user.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 07:56 PM
Security Audit — agent-trust-hub — track