todo-archive

Pass

Audited by Gen Agent Trust Hub on Aug 4, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses git rev-parse --show-toplevel to programmatically determine the repository root. This is a standard practice for development tools and is used safely without untrusted input interpolation.
  • [EXTERNAL_DOWNLOADS]: The skill uses uv run to execute its internal Python helper. While uv is a package manager, it is used here to run a local script included with the skill, not to download external code.
  • [DATA_EXFILTRATION]: No network operations or external data transmissions were detected. The skill only performs local file reads and writes within the repository scope.
  • [PROMPT_INJECTION]: The instructions do not contain patterns designed to bypass safety filters or override system instructions. The use of IMPORTANT in metadata or code refers to standard functional requirements.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 4, 2026, 08:04 AM
Security Audit — agent-trust-hub — todo-archive