things-morning-organizer
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill operates within the expected parameters of a task management extension, using official tools to interact with the local 'Things' application.
- [DATA_EXFILTRATION]: The skill reads todo items, areas, and tags to perform its function. No network operations or external data transfers were identified, ensuring that personal information remains within the local environment.
- [COMMAND_EXECUTION]: The skill uses
things_update_todoandthings_add_todoto modify task attributes based on logic described in the instructions and the localassets/config.jsonfile. These actions are restricted to the task management domain. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data (todo titles and notes). While it lacks explicit delimiters for this data, its limited set of capabilities (tagging/moving tasks) and explicit prohibitions against deleting tasks significantly reduce the risk of indirect injection attacks.
Audit Metadata