trigger-dev-tasks
Fail
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: CRITICAL
Full Analysis
- [EXTERNAL_DOWNLOADS] (SAFE): The skill describes using build extensions to manage dependencies, including system packages (
aptGet), Python libraries (requirementsFile), and Node.js CLI tools (additionalPackages). These are standard features of the Trigger.dev platform and follow best practices for infrastructure-as-code. - [COMMAND_EXECUTION] (LOW): The skill documentation includes examples of using the
Bashtool and custom build layers that execute commands (e.g.,chmod +x). This is within the scope of configuring a background task environment. - [REMOTE_CODE_EXECUTION] (LOW): The
pythonExtensionallows for running Python scripts and inline Python code within the Node.js environment. While this is dynamic execution, it is a primary feature of the platform for multi-language task support. - [DATA_EXFILTRATION] (SAFE): There are no patterns suggesting unauthorized data exfiltration. The automated scanner alert for
logger.infoas a malicious URL is a false positive;logger.info()is a standard logging function and the.infosegment was likely misidentified as a Top-Level Domain (TLD) by the scanner. - [PROMPT_INJECTION] (SAFE): No patterns of prompt injection, instruction overrides, or adversarial role-play were found.
- [CREDENTIALS_UNSAFE] (SAFE): The skill correctly recommends using environment variable synchronization (
syncEnvVars) for managing secrets rather than hardcoding them.
Recommendations
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata