deepagents-planning-todos

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill describes patterns for agents to process external data, which creates a surface for indirect prompt injection.\n
  • Ingestion points: The agent implementation in assets/examples/todo-driven-agent/agent.py processes user messages and simulated documentation. Patterns in references/todo-patterns.md ingest data from web searches (via Tavily) and PDF files.\n
  • Boundary markers: The example system prompts do not define explicit boundary markers or instructions to ignore instructions embedded in retrieve content.\n
  • Capability inventory: The skill demonstrates agents with capabilities including filesystem access, network operations, and task delegation to subagents.\n
  • Sanitization: The provided examples do not include mechanisms for sanitizing or filtering instructions that might be embedded in the data retrieved from search results or documents.\n- [COMMAND_EXECUTION]: The skill includes executable Python scripts intended for local execution by the user.\n
  • scripts/visualize_todos.py is a utility script that parses local JSON trace files to generate visualizations.\n
  • assets/examples/todo-driven-agent/agent.py is a demonstration script that runs a local agent loop.\n- [EXTERNAL_DOWNLOADS]: The documentation and setup instructions in SKILL.md and assets/examples/todo-driven-agent/README.md guide the user to install dependencies from public registries using package managers like uv.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 11:25 AM
Security Audit — agent-trust-hub — deepagents-planning-todos