ClawHub
Back to skill

Security audit

Team Task Dispatch

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for OpenAnt team coordination, but it tells agents to make shared workflow changes without confirmation and includes a parent-task submit command outside its declared tool scope.

Install only if you are comfortable with an agent changing OpenAnt task state automatically. Before using it in a shared team workflow, consider adding explicit confirmation for creating subtasks, approving or rejecting work, submitting subtasks, and especially submitting the parent task; the declared allowed-tools should also be corrected if parent task submission is intended.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The manifest restricts Bash access to read-oriented OpenAnt commands, but the skill body instructs the agent to perform state-changing operations such as create, claim, start, submit, and review. This mismatch is dangerous because it can cause the model to plan or attempt actions outside the declared permission boundary, undermining tool-governance assumptions and increasing the risk of unauthorized workflow changes if enforcement is weak or bypassable.

Scope Creep

High
Confidence
99% confidence
Finding
The skill explicitly instructs `openant tasks submit <taskId> ...`, but that action is not covered by the declared allowed-tools. A parent-task submission can finalize deliverables and alter project state, so documenting it outside the declared permission model creates a direct integrity risk and can mislead the agent into exceeding intended authority.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The autonomy table authorizes immediate execution of claiming, starting, submitting, creating subtasks, and approving/rejecting reviews with no confirmation. In this context, those are consequential state-changing actions affecting shared team workflows, so allowing them silently increases the chance of accidental task assignment, premature approvals, erroneous rejections, or unauthorized project progression.

Static analysis

No suspicious patterns detected.