task-steward
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially untrusted data during its task review process, which presents an attack surface for indirect prompt injection.
- Ingestion points: The skill reads project goals, existing tasks, and decomposition records directly from the filesystem (e.g., from
<feature-workspace>/decomposition.mdor.scratch/directories). - Boundary markers: There are no defined boundary markers or specific instructions for the agent to isolate the content of ingested task descriptions from its primary instructions.
- Capability inventory: The skill allows for filesystem write operations to the
decomposition.mdfile within the feature workspace. - Sanitization: The instructions do not contain logic for sanitizing or validating the text of the tasks being reviewed or split.
- [NO_CODE]: The skill does not include any executable scripts (Python, JavaScript, shell, etc.) or external binary dependencies. Its functionality is entirely defined through natural language instructions for the AI agent.
Audit Metadata