ClawHub
Back to skill

Security audit

Google Tasks

Security checks for vulnerabilities and agentic risk

Overview

This Google Tasks skill is mostly coherent, but it gives agents delete and bulk cleanup authority without clear confirmation guidance and includes mutable setup install commands.

Review before installing. Only use this skill with an AgentPMT/Google Tasks account where agent-driven task changes are acceptable, require explicit user confirmation before task deletion, task-list deletion, or clearing completed tasks, and prefer pinned or verified setup paths instead of unpinned npx commands.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:353
Finding

Unpinned Third-Party Setup Dependencies Enable Supply-Chain Compromise

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:353-369
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

markdown
If those setup skills are not installed beside this product skill, use the downloads below.

Core AgentPMT setup skills:
- What AgentPMT is: ../what-is-agentpmt
  - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt
  - OpenClaw install: `openclaw skills install what-is-agentpmt`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup
  - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup
  - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`

skills.sh install script:

```bash
npx skills add AgentPMT/agent-skills --skill what-is-agentpmt
npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup
text

### Technical Analysis

The documented setup procedure retrieves and installs third-party tooling and skills without specifying an immutable package version, repository commit, or integrity digest. In particular, invoking `npx skills` may download and execute the version currently resolved by the package registry. The referenced AgentPMT skills are also selected by mutable names rather than reviewed immutable revisions.

Consequently, the effective setup payload can change after this skill has been audited. Compromise of the npm package, package publisher, upstream repository, skill registry, or distribution account could cause users following these instructions to retrieve malicious content.

The main project itself contains no embedded executable payload, and no evidence demonstrates that the current dependencies are malicious. The 
...[truncated 1559 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the npm installer package to a reviewed exact version rather than relying on the registry's current resolution.
  2. Pin each external skill to an immutable repository commit, signed release, or content-addressed artifact.
  3. Publish and verify cryptographic hashes or signatures before installation.
  4. Use package-lock or equivalent lock metadata where supported, and reject unexpected dependency changes.
  5. Disable or explicitly review package lifecycle scripts before allowing installation in a privileged environment.
  6. Download and inspect external skills before loading them into an agent session; do not automatically trust updated remote instructions.
  7. Run installation in a sandbox with minimal filesystem, network, credential, and environment-variable access.
  8. Require explicit user confirmation before downloading or executing dependencies.
  9. Document the expected publisher identity, package version, skill revision, and integrity value directly in SKILL.md.
  10. Prefer a verified first-party distribution channel and implement signed-release verification throughout the update process.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (15)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill documents destructive operations such as deleting task lists, deleting tasks, and clearing completed tasks without warning about irreversibility or recommending confirmation. In an agent setting, that omission can lead to silent data loss when an LLM or workflow selects a destructive action based on ambiguous user input.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

delete_tasklist can remove an entire task list, likely affecting many tasks at once, but the description lacks a clear warning about irreversible or large-scale data loss. Because this skill manages user productivity data and supports agent-mediated actions, weak signaling around list deletion makes accidental destructive execution more dangerous than single-item operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The description uses expansive discovery language and generic task-management phrasing, which may cause unintended activation by orchestration systems matching on broad semantic cues. In the context of a tool that can read, modify, and delete personal task data, accidental activation raises the risk of privacy exposure and unwanted changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation keywords include broad generic terms such as tasks, which can cause the skill to be selected in unrelated contexts. Because this skill exposes destructive operations like delete and clear-completed, overbroad invocation increases the chance of unintended access to task data or unintended state-changing actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

The skill includes installation commands using npx skills without pinning a package version or immutable source reference. That creates a supply-chain risk because a future compromised or changed package version could be fetched and executed by users following the instructions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

This line again instructs use of npx skills without version pinning, which allows execution of whatever package version is current at install time. In a skill distribution channel, that weakens reproducibility and exposes users to upstream package compromise or silent behavior changes.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

The skill repeats an unpinned npx skills installation command, preserving the same remote-code/supply-chain exposure. Because users may copy these commands directly, the lack of pinning materially increases risk if the dependency is tampered with.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

This installation example also relies on an unpinned package fetch via npx, making the executed code dependent on the latest registry state. That is dangerous in deployment documentation because it can turn a safe skill into a delivery vector for malicious package updates.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

The command at this location uses npx skills without a fixed version, leaving consumers vulnerable to non-deterministic installs and package substitution. Even though it appears in reference/setup text, it still directs users to execute remote code from a mutable source.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

This is another instance of unpinned npx execution in installation guidance, carrying the same supply-chain risk. Repetition across the skill increases the chance that users follow at least one unsafe command path.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 439)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/google-tasks
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 440)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/google-tasks
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

clear_completed performs a destructive bulk action, but the description does not clearly warn that completed tasks will be removed from the task list. In agent-driven workflows, missing safety language increases the chance of accidental mass deletion when a user intended a reversible cleanup or archival step.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

delete_task is a destructive action, yet the markdown description does not warn about deletion consequences or whether recovery is possible. In an autonomous or semi-autonomous agent context, that omission raises the risk of unintended data loss from ambiguous user requests like 'clean up' or 'remove old items'.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The update_task action is labeled as a full update, but the schema shows optional fields and explicitly says it merges with existing data. This semantic mismatch can cause agents or developers to make incorrect assumptions about overwrite behavior, leading to unintended retention or modification of task data and unsafe automation logic.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.