issue-todo
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill is a legitimate utility for developers to manage task dependencies. Analysis of the scripts reveals no evidence of prompt injection, obfuscation, persistence mechanisms, or unauthorized data access.
- [COMMAND_EXECUTION]: The skill leverages the 'git', 'gh' (GitHub CLI), and 'curl' binaries to interact with local repositories and remote APIs. These commands are executed with well-defined arguments and are restricted to the skill's stated purpose of issue tracking and documentation management.
- [EXTERNAL_DOWNLOADS]: Retrieves issue metadata and comments from GitHub and Jira and downloads image attachments for Confluence documentation via curl. The skill includes defensive measures such as file signature verification to ensure downloaded content matches expected image formats.
- [CREDENTIALS_UNSAFE]: The skill correctly handles sensitive information like Jira and Confluence API tokens by reading them from environment variables or a local settings file in the user's home directory (~/.issue/settings.json), avoiding hardcoded secrets.
Audit Metadata