pachca-tasks
Pass
Audited by Gen Agent Trust Hub on Mar 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and executes the official
@pachca/clipackage from the NPM registry using thenpxcommand. - [COMMAND_EXECUTION]: Utilizes Bash commands to interact with the CLI tool for creating, retrieving, updating, and deleting tasks.
- [PROMPT_INJECTION]: The skill ingests untrusted data when listing tasks (
pachca tasks list). If task content contains instructions, it could lead to indirect prompt injection. - Ingestion points: Output of
pachca tasks listinSKILL.md. - Boundary markers: None provided in the command output handling.
- Capability inventory: Allows execution of
npx,pachca,which, andnpmvia Bash. - Sanitization: No explicit sanitization of task content before displaying to the agent.
Audit Metadata