pflow-task-next
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted task titles and descriptions, creating a surface for indirect prompt injection where malicious task content could attempt to influence the agent's branch-naming logic or subsequent actions.
- Ingestion points: Task data is ingested from the local file system via the output of
mdtodowithin thescripts/task-next-context.shscript. - Boundary markers: The script wraps the ingested data in a JSON structure before passing it to the agent, providing a technical delimiter.
- Capability inventory: The skill possesses the capability to modify the git repository's state by creating and switching to new branches via
scripts/task-next-branch.sh. - Sanitization: The instructions explicitly constrain the agent to produce a kebab-case slug using a restricted character set (a-z0-9-). Furthermore, the
scripts/task-next-branch.shscript performs strict validation of the proposed branch name usinggit check-ref-formatbefore execution, preventing command injection or the creation of malicious references.
Audit Metadata