things-morning-organizer

Pass

Audited by Gen Agent Trust Hub on Apr 13, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill operates within the expected parameters of a task management extension, using official tools to interact with the local 'Things' application.
  • [DATA_EXFILTRATION]: The skill reads todo items, areas, and tags to perform its function. No network operations or external data transfers were identified, ensuring that personal information remains within the local environment.
  • [COMMAND_EXECUTION]: The skill uses things_update_todo and things_add_todo to modify task attributes based on logic described in the instructions and the local assets/config.json file. These actions are restricted to the task management domain.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data (todo titles and notes). While it lacks explicit delimiters for this data, its limited set of capabilities (tagging/moving tasks) and explicit prohibitions against deleting tasks significantly reduce the risk of indirect injection attacks.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 13, 2026, 06:30 AM