Agent Task Manager

Manages and orchestrates multi-step, stateful agent workflows; handles task dependencies, persistent state, error recovery, and external rate-limiting. Use f...

Security Scan

The skill largely does what its name says (orchestrates multi-step agent workflows via an external API), but there are inconsistencies in its declared requirements and some risky patterns (shell eval wrapper, undisclosed API requirement) that warrant caution before installing.

Purpose & Capability

The skill's name, description, and code align: it orchestrates multi-step workflows, persists local state, manages cooldowns, and routes LLM/notification calls to a single API (api.heybossai.com). Requiring an API key for SkillBoss is coherent with its purpose. However, the registry metadata lists no required environment variables while SKILL.md and the Python code clearly expect SKILLBOSS_API_KEY — a metadata inconsistency.

Instruction Scope

Runtime instructions and code confine activity to workflow parsing, local JSON state (task_state.json), a timestamp directory (agent_task_manager_data), and HTTP calls to the SkillBoss API Hub. That scope matches the claimed functionality. Two points to note: (1) cooldown.sh uses eval "$COMMAND" which lets wrapped commands execute arbitrary shell code if the wrapper is used with untrusted inputs, and (2) fallback parsing sends user text to the external LLM and then attempts to parse returned JSON without robust validation. These are design risks but are explainable by the skill's purpose.

Install Mechanism

There is no install spec (instruction-only with included scripts), so nothing is downloaded automatically. That minimizes install-time risk — code files are bundled with the skill and run locally.

Credentials

Functionality requires a single external credential (SKILLBOSS_API_KEY) which is proportionate to the skill's use of the SkillBoss API. The problem is that the registry metadata lists no required env vars while SKILL.md and multiple code files directly read SKILLBOSS_API_KEY (os.environ["SKILLBOSS_API_KEY"]). This mismatch is an incoherence that could lead to runtime errors or accidental disclosure because the registry did not declare the secret requirement.

Persistence & Privilege

The skill persists state locally (task_state.json and agent_task_manager_data/<key>_last_run.txt) which is expected for an orchestrator. always:false (not force-included) and no claims of modifying other skills or system-wide settings. Note: because it can be invoked autonomously and has outbound network access (SkillBoss API), an exposed API key would permit external communication — consider the usual caution about keys for autonomously-invoked skills.

What to consider before installing

This skill appears to implement an agent orchestrator that uses the SkillBoss API — which is consistent with its description — but take these precautions before installing or using it: - Metadata mismatch: The registry shows no required env vars but both SKILL.md and the code require SKILLBOSS_API_KEY. Expect to provide that API key; ask the publisher to correct the registry metadata. - Limit the credential: If you try the skill, use a dedicated SkillBoss API key with minimal privileges and scope (not your primary org key). Rotate or revoke the key after testing. - Review or remove cooldown.sh if you will run wrapped commands: cooldown.sh uses eval to run arbitrary commands; do not pass untrusted text into it. If you won't use it, remove or harden the script to avoid eval. - Sandbox first: Run the skill in an isolated environment to observe behavior (network calls, files written: task_state.json and agent_task_manager_data/). Check what is sent to api.heybossai.com and whether responses are parsed safely. - Validate parser outputs: The task parser trusts the LLM response and json.loads it; validate that returned JSON matches the schema before executing tasks. - Verify source: The skill lists no homepage and the owner ID is opaque. If you need to run this in production, ask the publisher for provenance, a code repository, or a signed release so you can audit the source. If you cannot confirm the source or do not want to provide an API key, do not install or run this skill. If you proceed, use a least-privilege key and test in a sandbox first.

Overview

This skill provides the structure and primitives for building resilient, complex, and professional multi-agent systems powered by the SkillBoss API Hub. It transforms simple scripts into production-ready workflows, with AI capabilities (LLM reasoning, notification delivery) routed through a single unified endpoint.

Core Capabilities

1. Orchestration and Task State

• Capability: Defines tasks with clear inputs, outputs, and dependencies (DAG-like structure).
• Execution: Uses molt_task.py to manage state in task_state.json.
• Value: Prevents redundant work, allows agents to resume mid-workflow after a session reset.

2. External Rate-Limit Management

• Capability: Manages the cooldown and retry logic for externally rate-limited actions (e.g., API posts, web scrapes).
• Execution: Uses the scripts/cooldown.sh wrapper to store last-executed timestamps and automatically wait/retry.
• Value: Ensures continuous operation without violating API rate limits.

3. Modular Role-Based Agents

• Capability: Provides a template structure for specialized roles (e.g., ContractAuditor, FinancialAnalyst).
• Execution: Modules are designed to be run independently or sequenced by the Orchestrator. AI reasoning steps call the SkillBoss API Hub (/v1/pilot) for LLM inference and notification delivery.
• Value: Enables the creation of focused, expert agents for complex tasks like the MoltFinance-Auditor.

Example Workflow: MoltFinance-Auditor

1. Task: FinancialAudit
2. Dependencies:
   • Role 1: ContractAuditor (Input: Contract Address, Output: Contract Safety Score)
   • Role 2: FinancialAnalyst (Input: Contract Address + Safety Score, Output: Trust Score via SkillBoss API Hub LLM)
3. External Action: NotificationAgent (Dependent on final Trust Score; delivers alert via SkillBoss API Hub email/SMS; subject to Rate Limit).

API Integration

All AI inference and notification delivery is handled through SkillBoss API Hub:

• Endpoint: https://api.heybossai.com/v1/pilot
• Auth: Authorization: Bearer $SKILLBOSS_API_KEY
• LLM response path: data.result.choices[0].message.content

Resources

scripts/

• molt_task.py: Python class for task state management.
• orchestrator.py: Workflow execution engine; calls SkillBoss API Hub for AI role execution.
• task_parser.py: Converts natural language requests to task structures; uses SkillBoss API Hub LLM as fallback parser.
• cooldown.sh: Shell wrapper for managing rate-limited executions.

references/

• task_schema.md: JSON schema for defining complex task dependencies.