task-master-planner
Warn
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructs the agent to read highly sensitive local files such as
.context/auth/overview.md,.context/api/headers.md, and.context/feature-flags.mdto inform its planning process. These details are then used to populate GitHub issues, milestones, and task lists, creating a path for sensitive internal architectural or credential-related information to be exposed to external platforms. - [COMMAND_EXECUTION]: Section 8 requires the agent to generate GitHub Action workflows (
taskmaster-dispatch.yml,taskmaster-event-sync.yml, etc.) if they are missing. This constitutes dynamic generation of executable CI/CD logic, which could be exploited to run arbitrary commands in the repository's runner environment. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes untrusted external data from files like
DesignSpec.mdandProjectArchitecture.mdto drive its core logic. - Ingestion points:
DesignSpec.md,ProjectArchitecture.md, and the entire.context/directory. - Boundary markers: No delimiters or instructions to ignore embedded commands are specified for the ingested content.
- Capability inventory: GitHub API access (creating/updating issues and milestones), file system writes (
tasks/todo.md,tasks/lessons.md), and GitHub Action workflow generation. - Sanitization: No validation or sanitization is performed on the content of the design documents before it is used to generate tasks and GitHub issues.
Audit Metadata