The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions direct the user to install the task-master-ai package via NPM. This involves downloading third-party code from a public registry that is not associated with the predefined trusted vendors.
[REMOTE_CODE_EXECUTION]: The recommended configuration uses npx -y task-master-ai, which downloads and executes the package from the internet at runtime. Executing unverified packages from public registries poses a risk of supply chain attack if the package is compromised.
[COMMAND_EXECUTION]: The skill's primary interface involves shell commands (npm, npx), granting the AI agent the capability to execute code and scripts on the host environment.
[PROMPT_INJECTION]: The skill possesses a high surface area for indirect prompt injection by design. It parses Product Requirements Documents (PRDs) and implementation findings to generate and update tasks. If these files or findings are sourced from untrusted contributors or external documentation, they may contain malicious instructions.
Ingestion points: .taskmaster/docs/prd.txt, iterative implementation logs, and implementation findings.
Boundary markers: Absent. No specific delimiters or safety warnings for the agent to ignore instructions within the documentation are provided.
Capability inventory: Shell command execution via npx, task management operations, and AI provider API integrations (Anthropic, Perplexity).
Sanitization: Not specified.

task-master