todoist
Pass
Audited by Gen Agent Trust Hub on May 2, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it retrieves and processes task, project, and comment data from the external Todoist API.
- Ingestion points: Data is fetched from the Todoist API via the
api()function inscripts/todoist.pyand returned as JSON to the agent. - Boundary markers: The instructions in
SKILL.mddo not provide delimiters or instructions to ignore embedded commands within the retrieved task content or descriptions. - Capability inventory: The skill uses
Bash(python3 *)to executescripts/todoist.py, which has capabilities for network access (targetingapi.todoist.com) and file system access (reading and writing the.apikeyfile). - Sanitization: The Python script and accompanying instructions do not include mechanisms to sanitize, validate, or escape the content returned by the API before it is interpolated into the agent's context.
Audit Metadata