Security audit

Vikunja Task Api

Security checks for vulnerabilities and agentic risk

Overview

This Vikunja task skill is broadly related to its stated purpose, but it overreaches and includes unsafe install and credential-handling guidance that users should review before installing.

Review before installing. Use HTTPS only, avoid the curl-to-/usr/local/bin helper install unless you pin and verify the script, store tokens in a secret manager or tightly permissioned file instead of ~/.bashrc, and require explicit confirmation before deletes, bulk changes, sharing, team/member changes, or attachment operations.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:130
Finding: Global Agent Task-State Instruction Hijacking
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:105
Finding: Mutable Remote Executable Downloaded and Installed Without Verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:112
Finding: Bearer Token Persisted in Plaintext Shell Startup Configuration
Content: View full analysis
> ~/.bashrc echo 'export VIKUNJA_TOKEN="tk_your_token"' >> ~/.bashrc source ~/.bashrc ``` ### Technical Analysis The setup instructions encourage users to store a long-lived bearer token directly in `~/.bashrc`. Shell startup files are plaintext, are read by many interactive shell sessions, and are frequently copied into backups, diagnostic archives, dotfile repositories, or support bundles. Exporting the token also makes it available to child processes launched from that shell. This increases the number of processes and tools that may access the credential. The recommendation conflicts with the earlier suggestion to use a dedicated secure environment file. The example uses a placeholder, but its stated purpose is for the user to substitute an actual token, so the resulting configuration would contain a real secret. ### Attack Path 1. A user replaces the placeholder with a valid Vikunja bearer token and appends it to `~/.bashrc`. 2. The file is read by another local process, included in a backup or diagnostic archive, or accidentally committed to a dotfile repository. 3. An attacker obtains the token. 4. The attacker submits authenticated requests to the associated Vikunja instance. 5. The attacker exercises every permission granted to that token until it expires or is revoked. ### Impact Assessment The attacker obtains the effective Vikunja privileges assigned to the exposed token. Depending on token scope, this may include reading task and project information, creating or changing tasks, deleting records, accessing attachments and comments, managing project members, or creating share links. This issue does not inherently provide operating-system privilege escalation, but it can compromise the confidentialit ...[truncated 84 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: vikunja.sh:55
Finding: Credentials and Bearer Tokens May Be Transmitted Over Cleartext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: vikunja.sh:55
Finding: Unescaped Values Interpolated into JSON Request Bodies
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (39)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code is clearly related to Vikunja and uses its API, so the general domain matches. However, the declared description significantly overstates functionality. The script only supports a narrow set of task/project commands and authentication. There is no evidence of endpoints or commands for labels, teams, views, comments, attachments, or bulk operations, and it is not a full v2 API integration. This is a description/behavior mismatch due to substantial overclaiming of supported capabilities.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.
md
Save `vikunja.sh` to a directory in your PATH for convenient CLI access:

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
on: Bearer $VIKUNJA_TOKEN" | jq '.[] | {id,title}'

text
**Step 4: Optional — Install the Helper Script** Save `vikunja.sh` to a directory in your PATH for convenient CLI access: ```bash curl -sL https://raw.githubusercontent.com/ashanzzz/openclaw-person-skills/main/skills/vikunja-task-api/vikunja.sh \ -o /usr/local/bin/vikunja && chmod +x /usr/local/bin/vikunja

Then configure:

bash
echo 'export VIKUNJA_URL="http://your-vikunja-instance:3456"' >> ~/.bashrc echo 'export VIKUNJA_TOKEN="tk_your_token"' >> ~/.bashrc source ~/.bashrc

Usage examples:

bash
vikunja list # List all open tasks vikunja due-today # Tasks due today vikunja create 9 "New task" # Create task in project 9 vikunja done 123 # Mark task 123 as done vikunja show 123 # Show task details

Use Vikunja as the source of truth for all task management. This skill supersedes any internal working-buffer tracking for user-visible

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents extensive shell-based capabilities but does not declare any tool scope or allowed-tools boundary. That omission weakens least-privilege controls and can let an agent invoke shell/network operations that users or the platform did not explicitly approve.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: The skill instructs users to download and execute a remote script directly into a PATH location without integrity verification, pinning, or code review. This creates a supply-chain risk: if the upstream repository or network path is compromised, arbitrary code could be installed and later executed with the user's privileges.
Content: Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.
Save vikunja.sh to a directory in your PATH for convenient CLI access:

bash
curl -sL https://raw.githubusercontent.com/ashanzzz/openclaw-person-skills/main/skills/vikunja-task-api/vikunja.sh \ -o /usr/local/bin/vikunja && chmod +x /usr/local/bin/vikunja

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advises placing long-lived credentials in shell startup files like ~/.bashrc, which exposes them to accidental disclosure through dotfile syncing, local compromise, shell history debugging, or other processes/users with read access. Persisting API tokens in general-purpose startup files is unnecessary and broadens credential exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The markdown includes destructive operations such as delete project/task/label without any warning, confirmation guidance, or safety rails. In an agent setting, such examples can normalize or trigger unsafe state-changing actions that cause irreversible data loss.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.
md
-H "Authorization: Bearer $VIKUNJA_TOKEN" | jq '.[] | {id,title,owner}' # Create project (PUT, not POST!) curl -X PUT "$VIKUNJA_URL/api/v1/projects" \ -H "Authorization: Bearer $VIKUNJA_TOKEN" \ -H "Content-Type: application/json" \ -d '{"title":"Project Name","description":"","identifier":"","hex_color":""}' | jq '{id,title}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.
md
-H "Authorization: Bearer $VIKUNJA_TOKEN" | jq # Update project (POST) curl -X POST "$VIKUNJA_URL/api/v1/projects/{id}" \ -H "Authorization: Bearer $VIKUNJA_TOKEN" \ -H "Content-Type: application/json" \ -d '{"title":"New Title","hex_color":"#ff0000"}' | jq '{id,title}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.
md
| jq '.[] | {id,title,done,due_date}' # Create task in project (PUT, not POST!) curl -X PUT "$VIKUNJA_URL/api/v1/projects/{project_id}/tasks" \ -H "Authorization: Bearer $VIKUNJA_TOKEN" \ -H "Content-Type: application/json" \ -d '{"title":"Task Title","description":"","due_date":"2026-04-30T23:59:00Z"}' | jq '{id,title}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 228)May include surrounding context.
md
-H "Authorization: Bearer $VIKUNJA_TOKEN" | jq # Update task (POST) — including mark done curl -X POST "$VIKUNJA_URL/api/v1/tasks/{id}" \ -H "Authorization: Bearer $VIKUNJA_TOKEN" \ -H "Content-Type: application/json" \ -d '{"done":true,"title":"Updated Title"}' | jq '{id,done,done_at}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.
md
-d '{"done":true,"title":"Updated Title"}' | jq '{id,done,done_at}' # Delete task curl -X DELETE "$VIKUNJA_URL/api/v1/tasks/{id}" \ -H "Authorization: Bearer $VIKUNJA_TOKEN" # Bulk update tasks

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 244)May include surrounding context.
md
-d '{"tasks":[{"id":1,"done":true},{"id":2,"done":true}]}' | jq # Update task position (for drag-and-drop reordering) curl -X POST "$VIKUNJA_URL/api/v1/tasks/{id}/position" \ -H "Authorization: Bearer $VIKUNJA_TOKEN" \ -H "Content-Type: application/json" \ -d '{"position":0,"bucket_id":5}' | jq

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.
md
-d '{"position":0,"bucket_id":5}' | jq # Duplicate task curl -X PUT "$VIKUNJA_URL/api/v1/tasks/{id}/duplicate" \ -H "Authorization: Bearer $VIKUNJA_TOKEN" \ -H "Content-Type: application/json" \ -d '{"project_id":9}' | jq '{id,title}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.
md
-H "Authorization: Bearer $VIKUNJA_TOKEN" | jq # Add assignee curl -X PUT "$VIKUNJA_URL/api/v1/tasks/{id}/assignees" \ -H "Authorization: Bearer $VIKUNJA_TOKEN" \ -H "Content-Type: application/json" \ -d '{"user_id":1}' | jq

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.
md
-d '{"user_id":1}' | jq # Bulk add assignees curl -X POST "$VIKUNJA_URL/api/v1/tasks/{id}/assignees/bulk" \ -H "Authorization: Bearer $VIKUNJA_TOKEN" \ -H "Content-Type: application/json" \ -d '{"user_ids":[1,2,3]}' | jq

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.
md
-H "Authorization: Bearer $VIKUNJA_TOKEN" | jq # Add label to task curl -X PUT "$VIKUNJA_URL/api/v1/tasks/{id}/labels" \ -H "Authorization: Bearer $VIKUNJA_TOKEN" \ -H "Content-Type: application/json" \ -d '{"label_id":5}' | jq

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 294)May include surrounding context.
md
-d '{"label_id":5}' | jq # Bulk update labels on task curl -X POST "$VIKUNJA_URL/api/v1/tasks/{id}/labels/bulk" \ -H "Authorization: Bearer $VIKUNJA_TOKEN" \ -H "Content-Type: application/json" \ -d '{"labels":[{"label_id":5},{"label_id":8}]}' | jq

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 312)May include surrounding context.
md
-H "Authorization: Bearer $VIKUNJA_TOKEN" | jq # Create comment curl -X PUT "$VIKUNJA_URL/api/v1/tasks/{id}/comments" \ -H "Authorization: Bearer $VIKUNJA_TOKEN" \ -H "Content-Type: application/json" \ -d '{"comment":"This is a comment"}' | jq '{id,comment}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 318)May include surrounding context.
md
-d '{"comment":"This is a comment"}' | jq '{id,comment}' # Update comment curl -X POST "$VIKUNJA_URL/api/v1/tasks/{id}/comments/{comment_id}" \ -H "Authorization: Bearer $VIKUNJA_TOKEN" \ -H "Content-Type: application/json" \ -d '{"comment":"Updated comment"}' | jq

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 341)May include surrounding context.
-F "file=@/path/to/file.pdf" | jq

Delete attachment

curl -X DELETE "$VIKUNJA_URL/api/v1/tasks/{id}/attachments/{attachment_id}"
-H "Authorization: Bearer $VIKUNJA_TOKEN"

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 367)May include surrounding context.
md
-H "Authorization: Bearer $VIKUNJA_TOKEN" | jq '.[] | {id,title,hex_color}' # Create label curl -X PUT "$VIKUNJA_URL/api/v1/labels" \ -H "Authorization: Bearer $VIKUNJA_TOKEN" \ -H "Content-Type: application/json" \ -d '{"title":"Bug","hex_color":"#ff0000"}' | jq '{id,title}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 373)May include surrounding context.
md
-d '{"title":"Bug","hex_color":"#ff0000"}' | jq '{id,title}' # Update label curl -X PUT "$VIKUNJA_URL/api/v1/labels/{id}" \ -H "Authorization: Bearer $VIKUNJA_TOKEN" \ -H "Content-Type: application/json" \ -d '{"title":"Feature","hex_color":"#00ff00"}' | jq

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 395)May include surrounding context.
md
-H "Authorization: Bearer $VIKUNJA_TOKEN" | jq '.[] | {id,title}' # Create bucket curl -X PUT "$VIKUNJA_URL/api/v1/projects/{id}/views/{view_id}/buckets" \ -H "Authorization: Bearer $VIKUNJA_TOKEN" \ -H "Content-Type: application/json" \ -d '{"title":"To Do"}' | jq '{id,title}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 401)May include surrounding context.
md
-d '{"title":"To Do"}' | jq '{id,title}' # Update bucket curl -X POST "$VIKUNJA_URL/api/v1/projects/{project_id}/views/{view_id}/buckets/{bucket_id}" \ -H "Authorization: Bearer $VIKUNJA_TOKEN" \ -H "Content-Type: application/json" \ -d '{"title":"In Progress"}' | jq

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Ae1

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

Undeclared Tool Scope

External Transmission

Missing User Warnings

Missing User Warnings

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Delete attachment

External Transmission

External Transmission

External Transmission

External Transmission

Static analysis