todoist-automation
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes untrusted data from an external service.
- Ingestion points: External data enters the agent's context through tools such as
TODOIST_GET_ALL_TASKSandTODOIST_GET_TASK, which retrieve user-controlled task content and descriptions (SKILL.md). - Boundary markers: The instructions lack specific delimiters or warnings to the agent to ignore or isolate instructions that may be embedded within the retrieved task data.
- Capability inventory: The skill provides capabilities for data modification and destruction, including
TODOIST_UPDATE_TASK,TODOIST_DELETE_TASK, andTODOIST_DELETE_SECTION(SKILL.md). - Sanitization: There is no requirement or guidance for sanitizing, escaping, or validating the content retrieved from Todoist before the agent acts upon it.
Audit Metadata