Comment On Task

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:32 AM UTC
• Version: 0.1.1

Overview

The skill is coherent for OpenAnt task comments, but it can automatically post persistent external comments without confirmation and uses broad Bash command patterns.

Review this skill before installing. It should only be used when you intentionally want an agent to read or post OpenAnt task comments; require explicit confirmation before posting, avoid secrets or internal reasoning in comment content, and validate task IDs or use a safer structured OpenAnt tool instead of raw Bash interpolation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:6

Finding

Shell Command Injection Through Unrestricted Bash Arguments

Content

View full analysis

--json ``` ```bash openant tasks comment --content "..." --json ``` ### Technical Analysis The skill grants access to Bash commands with arbitrary trailing arguments through the wildcard patterns `openant tasks comments *` and `openant tasks comment *`. It then instructs the agent to interpolate a task ID and comment content directly into shell command strings. No validation rules are specified for `taskId`, and no shell-safe mechanism is required for passing comment content. If attacker-controlled values are inserted literally, shell metacharacters in a task ID could terminate or extend the intended command. Comment content enclosed in double quotes may also permit command substitution through constructs such as `$()` or break out of the quoted argument when quotes are not safely escaped. The `--json` requirement only affects the OpenAnt command's output format. It does not prevent the shell from evaluating malicious syntax before invoking the CLI. ### Attack Path 1. An attacker supplies a crafted task ID or requests that the agent post attacker-controlled comment content. 2. The agent follows the documented examples and interpolates the supplied value into an allowed Bash command. 3. The crafted value introduces shell syntax, such as a command separator, quote termination, or command substitution. 4. Bash evaluates the injected syntax in addition to the intended `openant` command. 5. The injected command executes with the operating-system privileges and environment access available to the agent process. Exploitation depends on attacker-controlled data being inserted into the shell command without robust validatio ...[truncated 759 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description includes broad trigger phrases like "comment on task," "ask the creator," and "update progress," which can overlap with common agent behaviors and cause the skill to be invoked in many routine contexts. Because the skill enables external communication and persistent writes, overly broad routing increases the chance of unintended disclosure or posting to an external system.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

The autonomy section instructs the agent to execute comment-posting immediately with no confirmation, despite comments being external side effects and persistent writes. This removes an important human approval checkpoint and can lead to unauthorized communications, privacy breaches, or reputational harm if the agent posts inaccurate or sensitive information.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

## Autonomy

Adding comments is a **routine operation** — execute immediately for progress updates, questions, and acknowledgments. No confirmation needed.

## Error Handling

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly permits posting comments to an external task system without any warning that this transmits data outside the agent and creates a persistent record. That creates a real risk of leaking sensitive information, posting incorrect status updates, or sending internal reasoning/progress details to third parties without user awareness.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.