tasks
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes external markdown content from PRD files and transforms it into executable task structures within
prd.json. Because it lacks input sanitization or boundary markers to distinguish between data and instructions, it is susceptible to indirect prompt injection. Maliciously crafted requirements or user stories in the source markdown could be converted into unauthorized shell commands or browser actions that an agent would subsequently execute. - Ingestion Point: Reads markdown files from paths like
tasks/prd-[feature-name].md. - Boundary Markers: None observed; the skill is instructed to "extract tasks" and "explode each task" directly from the content.
- Capability Inventory: The skill generates commands for shell execution (e.g.,
npm run typecheck,npm test) and complex browser automation viaagent-browser. - Sanitization: No logic is present to validate or filter the content of the extracted tasks before generating the output JSON.
- [EXTERNAL_DOWNLOADS]: The skill references and provides documentation for
agent-browser, an automation tool hosted in Vercel Labs' public GitHub repository. This external dependency is used according to its design for browser-based verification and does not involve untrusted or unverified sources.
Audit Metadata