Agent Task Manager

• Outcome: Review
• Latest audit: May 28, 2026 · 8:44 AM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it can send user task content and notifications through an external API with broad scope and limited user-control guidance.

Install only if you are comfortable sending task descriptions, workflow data, notification text, and recipient details to the SkillBoss/HeyBoss API. Avoid using it with secrets, private business workflows, regulated data, or unapproved contacts unless you add explicit confirmation, redaction, recipient controls, and safer command handling around the included scripts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises significant capabilities involving environment variables, file read/write, and network access, but does not declare any permissions or user-visible warnings about those operations. This creates a transparency and governance failure: users and policy systems cannot accurately assess that the skill can read secrets, persist state, and transmit data externally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose describes generic workflow orchestration, but the documented behavior includes external LLM parsing, outbound notifications, crypto-specific alerting, and a referenced shell eval path in the cooldown script. This mismatch is dangerous because it hides higher-risk behaviors behind a broad orchestration label, increasing the chance that users invoke the skill without understanding that prompts, task data, and potentially sensitive content may be sent to third parties or that command execution features may exist.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The orchestrator directly performs notification delivery through an external API, expanding the skill from workflow management into outbound communications. In this context, that matters because recipient identifiers and message bodies may be sent off-platform without clear separation of duties or explicit disclosure, increasing privacy and abuse risk.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The file reads an API credential from the environment and sends workflow data to a specific external AI hub, but that external integration is not clearly reflected in the stated orchestration-focused purpose. Hidden or under-declared networked AI dependencies are dangerous because they can silently transmit task contents, state, or identifiers to a third party.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code introduces a remote LLM dependency and consumes an API credential even though the skill is described primarily as workflow orchestration. That expands the skill's trust boundary and can expose user task content, operational metadata, and prompts to a third party without clear necessity or minimization.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The file adds natural-language interpretation via a remote API, which is materially broader than simple task orchestration. In this context, the mismatch matters because users may not expect free-form requests to leave the local agent boundary, increasing the risk of silent data sharing and unexpected behavior derived from model output.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The invocation description is broad enough to match many common workflow or productivity requests, which can cause the skill to activate in contexts where users did not intend external orchestration, persistence, or third-party transmission. In this skill, broad triggering is more dangerous because activation may lead to network calls, stateful file writes, and notification actions beyond what a user expects from a generic workflow helper.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill description omits a clear warning that user inputs, workflow content, and possibly derived outputs are transmitted to an external API and that notification delivery may occur through that provider. This lack of disclosure undermines informed consent and can expose sensitive operational or personal data to third-party services unexpectedly.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The notification function sends recipient and message content to an external API without any visible user warning, consent check, or privacy guard in this file. In an orchestration skill, that makes the behavior more dangerous because workflow outputs may contain sensitive operational or personal data that users do not expect to leave the local system.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Raw user requests are forwarded to an external API with no warning, consent, or filtering. Because natural-language requests may contain secrets, personal data, business plans, or operational instructions, this creates a meaningful privacy and data-governance risk even if the endpoint is legitimate.

External Transmission

Medium

• Category: Data Exfiltration

Content

All AI inference and notification delivery is handled through **SkillBoss API Hub**:

- **Endpoint:** `https://api.heybossai.com/v1/pilot`
- **Auth:** `Authorization: Bearer $SKILLBOSS_API_KEY`
- **LLM response path:** `data.result.choices[0].message.content`

• Confidence: 88% confidence
• Finding: The skill explicitly routes AI inference and notification delivery to an external endpoint, meaning workflow inputs and outputs can leave the local environment. External transmission is not inherently malicious, but in a stateful orchestration skill it raises meaningful confidentiality and compliance risks, especially if users provide secrets, internal task details, or personal contact data for notifications.

Static analysis

No suspicious patterns detected.