asana
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows secure integration practices, including the use of OAuth with PKCE and granular user consent for all actions. The instructions explicitly advise against requesting secrets in chat, following best practices for secret management.
- [COMMAND_EXECUTION]: The skill uses the asana CLI to interact with the Asana MCP server. Command execution is limited to predefined tools that are reviewed and advertised through the list-tools command.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from Asana (tasks, projects, comments) which could theoretically contain malicious instructions. However, this risk is mitigated by explicit user approval phrases for write actions and clear disclosure of data access in the consent screen, maintaining a controlled execution environment.
Audit Metadata