planning-tracker-sync
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's installation process involves downloading logic from the author's GitHub repository via the
npxcommand. - [COMMAND_EXECUTION]: The skill executes local Python scripts (
derive_state.py,tracker_diff.py) to process and diff project tracker data. - [DYNAMIC_EXECUTION]: The skill dynamically resolves file paths to execute logic from a companion skill (
zynkr-gm) located in the agent's local directory. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external Google Sheets and Fireflies meeting recaps. Although it uses this data to generate meeting agendas, it lacks explicit sanitization or context boundary markers to mitigate potential instructions embedded in the ingested content.
Audit Metadata