track
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill interfaces with local tools and system utilities, including a custom shell script (
work-item-tracker.sh),git,jq,mktemp, anddate. These operations are essential for its documented purpose of development task management. - [COMMAND_EXECUTION]: In the
addaction, the instructions direct the agent to write large content bodies to temporary files and pass them to the tracker tool via command substitution (e.g.,$(cat "$BODY_FILE")). This is a security-conscious approach implemented to avoid shell interpolation of complex or potentially untrusted user-supplied content. - [SAFE]: No patterns of prompt injection, data exfiltration, remote code execution, or persistence were detected. The skill's operations are confined to the local project environment and intended work item providers as configured by the user.
Audit Metadata