todo
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell scripts and CLI tools to manage the repository backlog.\n
- The skill uses
git,grep,awk, andsortwithin scripts located in thescripts/directory to query and update theTODO.mdfile.\n - The frontmatter
allowed-toolsconfigurationBash(sh ${CLAUDE_SKILL_DIR}/scripts/*)limits the agent's ability to execute arbitrary commands, restricting it to the provided scripts.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository files which could be manipulated to influence agent behavior.\n - Ingestion points: The skill reads content from
TODO.mdandSTORIES.mdat the repository root usinggrep,awk, andgit show(as seen inSKILL.md,scripts/list.sh, andscripts/stories.sh).\n - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are used when presenting the file content to the agent.\n
- Capability inventory: The skill has the ability to read and write repository files, execute local shell scripts, and perform various git operations (log, show, blame, etc.).\n
- Sanitization: No sanitization or validation of the content within the
TODO.mdorSTORIES.mdfiles is performed before the content is ingested into the agent context.
Audit Metadata