plan-ledger-tasks-yylo
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is configured with
enable-shell-directives: true, allowing it to execute shell commands. It specifically instructs the agent to invoke a local project script located at.juno_task/scripts/kanban.shto create and manage tasks. - [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection as it is designed to ingest and process untrusted external data, including project instructions and product code from a worktree.
- Ingestion points: The skill reads project instructions and product code (SKILL.md, step 1).
- Boundary markers: There are no explicit delimiters or instructions to ignore potential injections within the ingested project data.
- Capability inventory: The skill can execute shell scripts and perform metadata operations (SKILL.md, steps 4 and 5).
- Sanitization: No evidence of sanitization or validation of the ingested content is present.
Audit Metadata