Leave Task

PassAudited by ClawScan on May 1, 2026.

Overview

This skill is a coherent OpenAnt task-unassignment helper, but users should notice that it runs an unpinned CLI command and can make a consequential account change after confirmation.

This skill appears safe for its stated purpose. Before installing or using it, understand that it can leave an accepted OpenAnt task, which may affect the task creator and your reputation. Approve the unassign command only after checking the task details, and be aware that it uses npx with @openant-ai/cli@latest rather than a pinned CLI version.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If run on the wrong task or without understanding the impact, the user could give up accepted work and reopen it for others.

Why it was flagged

The skill exposes Bash commands that can change an OpenAnt task assignment. This is purpose-aligned and bounded to OpenAnt task operations, but it is still a real account mutation.

Skill content

allowed-tools: ["Bash(npx @openant-ai/cli@latest status*)", "Bash(npx @openant-ai/cli@latest tasks unassign *)", "Bash(npx @openant-ai/cli@latest tasks get *)"]

Recommendation

Confirm the task title, reward, and task ID before approving the unassign command.

Low

#ASI03: Identity and Privilege Abuse

What this means

The action is performed under the user's OpenAnt account and may affect task reputation or availability.

Why it was flagged

The skill uses the user's authenticated OpenAnt identity to perform an action only the assigned worker can take.

Skill content

Only the **assigned worker** can unassign themselves. ... Step 1: Confirm Authentication ... npx @openant-ai/cli@latest status --json

Recommendation

Use only from the intended OpenAnt account and verify that you are the assignee before proceeding.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

A future CLI version could behave differently from the version reviewed here.

Why it was flagged

The skill relies on an unpinned @latest CLI package executed through npx. This is central to the stated purpose, but the exact CLI version may change over time.

Skill content

Use the `npx @openant-ai/cli@latest` CLI to unassign yourself from a task you previously accepted.

Recommendation

Prefer a pinned CLI version or install/use a trusted OpenAnt CLI version if reproducibility is important.