Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Git-backed todo coordinator; its main risk is that task details are committed and pushed to the configured repository.
Install this only for agents that should be allowed to run Git commands and publish todo metadata to a shared repository. Use a dedicated private repo or local bare repo, keep secrets and private transcripts out of task titles, descriptions, and results, and disable broad implicit use or reminder scheduling unless you intentionally want this agent to coordinate those todos.
Referenced artifact was not completely inspected
Resolve the directory containing this `SKILL.md` using the host runtime's skill-directory mechanism. Run `scripts/git_todo.py` from that directory. The CLI emit
Referenced artifact was not completely inspected
aining this `SKILL.md` using the host runtime's skill-directory mechanism. Run `scripts/git_todo.py` from that directory. The CLI emits JSON for reliable agent
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
"next_steps": [
f'export AGENT_TODO_REPO="{repo}"',
f'export AGENT_TODO_ID="{agent}"',
"Hermes: put the two exports above in ~/.hermes/.env (loaded at startup); "
"other shells: append them to your shell profile",
f"Other hosts: git clone {remote_url} and run "
f"setup --repo <clone-path> --agent <their-id>",
The skill explicitly requires shell execution, environment variables, and read/write access to a shared Git repository, but it does not declare any tool scope or permissions metadata to constrain those capabilities. In an agent ecosystem, that omission can cause the runtime or user to grant broader-than-expected access, increasing the chance of unsafe command execution or unintended file and credential exposure during setup and Git operations.
The skill enables implicit invocation while its activation context is broad and generic ('coordinate Todo tasks across AI agents through Git'). That creates a real risk of the skill being auto-invoked in situations involving repositories, tasks, or reminders without a narrowly scoped trigger, which can expose users to unintended Git operations, cross-agent data sharing, or prompt-surface expansion.
Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.
## Other agents
For any agent capable of reading Agent Skills or executing shell commands, install this directory as a skill or provide `SKILL.md` as persistent instructions. Resolve the skill directory, configure `AGENT_TODO_REPO` and `AGENT_TODO_ID`, and call the same Python CLI.
If a runtime cannot execute local commands, it cannot directly operate this version of the skill. Use an MCP/tool wrapper around `git_todo.py` rather than reimplementing the state machine.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def git(repo: Path, *args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
proc = subprocess.run(
["git", "-C", str(repo), *args],
text=True,
stdout=subprocess.PIPE,
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
def git(repo: Path, *args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
proc = subprocess.run(
["git", "-C", str(repo), *args],
text=True,
stdout=subprocess.PIPE,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def init_bare(path: Path) -> None:
path.parent.mkdir(parents=True, exist_ok=True)
proc = subprocess.run(
["git", "init", "--bare", "-q", str(path)],
text=True,
stdout=subprocess.PIPE,
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
def init_bare(path: Path) -> None:
path.parent.mkdir(parents=True, exist_ok=True)
proc = subprocess.run(
["git", "init", "--bare", "-q", str(path)],
text=True,
stdout=subprocess.PIPE,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
raise TodoError(proc.stderr.strip() or "git init --bare failed")
# Point HEAD at main so a later clone checks out the right branch
# instead of warning "remote HEAD refers to nonexistent ref".
head = subprocess.run(
["git", "--git-dir", str(path), "symbolic-ref", "HEAD", "refs/heads/main"],
text=True,
stdout=subprocess.PIPE,
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
raise TodoError(proc.stderr.strip() or "git init --bare failed")
# Point HEAD at main so a later clone checks out the right branch
# instead of warning "remote HEAD refers to nonexistent ref".
head = subprocess.run(
["git", "--git-dir", str(path), "symbolic-ref", "HEAD", "refs/heads/main"],
text=True,
stdout=subprocess.PIPE,
The setup/bootstrap flow automatically commits local files and pushes them to origin, potentially publishing repository metadata and future task contents to a remote without an explicit disclosure or confirmation step. In an agent setting, this is dangerous because users may assume local coordination while the tool silently establishes synchronization that can leak operational details to another host or service.
Task creation writes user-provided titles, descriptions, executor identities, timestamps, and optional results into repository files and then pushes them to the configured remote. This can unintentionally exfiltrate sensitive operational content, especially in multi-agent environments where tasks may contain secrets, plans, or customer data.
Lifecycle actions such as start, complete, and cancel update task state and may include completion results, then automatically publish those changes upstream. This creates a confidentiality risk because status changes and result text can reveal internal workflow, outputs, or sensitive completion notes without explicit user acknowledgement.
Notification receipts record notifier identity, task IDs, timestamps, and task-derived notification keys, then synchronize that metadata via Git. While lower impact than full task contents, this still leaks activity and coordination patterns that users may not expect to be stored remotely.
No suspicious patterns detected.