track
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local shell script (
bin/track.sh) located within the plugin root directory. This is the intended primary purpose of the skill to provide time-tracking functionality. - [COMMAND_EXECUTION]: The skill implements a security boundary for the
/track:stopcommand by usingprintf '%s' "<NOTE>" | bash ...to pipe user input through stdin. This follows best practices to avoid shell metacharacter interpretation and command injection. - [COMMAND_EXECUTION]: Arguments passed to other subcommands (like
start,pause,resume) are described as being validated by the target dispatcher script for specific patterns (e.g., alphanumeric client names, HH:MM time formats), reducing the risk of argument injection.
Audit Metadata