skills/skinnyandbald/ceos/ceos-todos/Gen Agent Trust Hub

ceos-todos

Pass

Audited by Gen Agent Trust Hub on Mar 3, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs a 'git pull' operation to synchronize data with a remote repository. This command is executed within a validated directory path identified by a marker file and is essential for the skill's collaborative features.
  • [EXTERNAL_DOWNLOADS]: Synchronization involves downloading updates from the repository's configured remote origin. This is a standard and expected behavior for a distributed task management tool.
  • [PROMPT_INJECTION]: The skill processes external markdown files from the 'data/todos/' directory (Ingestion point: data/todos/; Boundary markers: YAML parsing; Capabilities: Read, Write, Glob, git; Sanitization: Filename slugification). While this presents an indirect prompt injection surface, the risk is mitigated by the skill's use of structured YAML parsing and its narrow functional scope.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 3, 2026, 09:34 PM