util-manage-todo
Pass
Audited by Gen Agent Trust Hub on Feb 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill manages local todo files and ADR documents using provided Python scripts. All operations are local and perform standard file management and parsing.- [COMMAND_EXECUTION]: The skill uses the Bash tool to run common development utilities such as pytest, mypy, ruff, and grep. These commands are used for project maintenance and verification as part of the intended workflow.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from todo.md and ADR files (Category 8 surface). Ingestion points: Files like ./todo.md and ADR documents in docs/adr/ are read by todo_manager.py and refactor_validator.py. Boundary markers: The parsing logic relies on markdown headers (### Task) and specific labels (Status:) to delimit data fields. Capability inventory: The skill has access to Read, Write, Edit, Grep, and Bash tools. Sanitization: Content is parsed using regular expressions in scripts/state_manager.py and scripts/todo_manager.py, which enforces a structured format, although the agent may still interpret instructions within text fields like descriptions.
Audit Metadata