todo-archive

Pass

Audited by Gen Agent Trust Hub on Jun 14, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The helper script in scripts/archive_todo.py uses subprocess.run to execute git rev-parse --show-toplevel. This is a legitimate and safe operation used to identify the project root directory. It is implemented using a static list of arguments, which prevents shell injection vulnerabilities.
  • [SAFE]: The skill performs local file system operations, specifically reading and writing markdown task lists in TODO.md and .ai/todos/. The logic is transparently implemented in Python, does not involve any network communication, and does not access sensitive system files or credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 14, 2026, 10:39 AM
Security Audit — agent-trust-hub — todo-archive