skills/pachca/openapi/pachca-tasks/Gen Agent Trust Hub

pachca-tasks

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill interacts with the Pachca API by executing shell commands through the @pachca/cli tool.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the download and execution of the @pachca/cli package from the npm registry. Since the package is the official tool provided by the skill author (pachca), this is a standard and expected functional dependency.
  • [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes external data (task content and descriptions) from the Pachca service, which presents a potential injection surface.
  • Ingestion points: Data is ingested via pachca tasks list and pachca tasks get as described in SKILL.md.
  • Boundary markers: There are no explicit boundary markers or instructions to the agent to ignore potentially malicious content within task fields.
  • Capability inventory: The skill utilizes Bash capabilities to manage tasks and install dependencies.
  • Sanitization: No specific sanitization or escaping of task content is implemented before the data is presented to the agent's context.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 09:00 PM