task-queue-by-model-source

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:21 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent task-queue system, but it automatically installs ongoing background dispatch and can spawn agents from broad prompts without enough user control.

Install only if you intend to run a persistent background task dispatcher. Before using it, narrow the triggers, require confirmation before first-run setup, review or disable the cron and HEARTBEAT.md integration, and avoid queueing sensitive data unless local storage permissions and retention are handled separately.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:153

Finding

Automatic Installation of a Persistent Heartbeat Hook and Recurring Cron Job

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 153-191
Vulnerability Type: Persistent scheduled execution
Risk Level: Critical

Vulnerable Code

text

**Run this check before anything else, every INTAKE invocation:**

CHECK whether ${MODEL_QUEUES_DIR}/ exists and has queue files
IF no queue files exist:
  → This is the first run. Auto-configure.
  
  [1] Create directory:
      exec: mkdir -p ${MODEL_QUEUES_DIR}
  
  [2] For each MODEL_SOURCE_* in TOOLS.md:
      CREATE ${MODEL_QUEUES_DIR}/{source_name}.json:
      {
        "version": "1.0",
        "source": "{source_name}",
        "models": [list of models],
        "maxConcurrent": 1,
        "maxRetries": ${MODEL_QUEUE_MAX_RETRIES},
        "lastId": null,
        "tasks": []
      }
  
  [3] Register heartbeat entry:
      READ HEARTBEAT.md
      IF "Model Queue Dispatcher" NOT in file:
        APPEND:
        ## Model Queue Dispatcher
        Every heartbeat: check ${MODEL_QUEUES_DIR} for pending/running tasks
        - If tasks exist → run DISPATCHER mode
        - If nothing pending → HEARTBEAT_OK
  
  [4] Register backup cron job:
      CALL cron tool:
        action: "add"
        job:
          name: "Model Queue Dispatcher"
          schedule: { kind: "every", everyMs: 900000 }
          payload: { kind: "systemEvent", text: "MODEL_QUEUE_DISPATCH: check queues and run pending tasks" }
          sessionTarget: "main"
          enabled: true

Technical Analysis

The first intake invocation directs the agent to modify HEARTBEAT.md and register an enabled cron event that targets the main session every 15 minutes. These changes survive the originating skill invocation and repeatedly cause the dispatcher to process queue state.

This behavior establishes two persistent activation paths: an instruction executed during every heartbeat and a recurring scheduled system event. I ...[truncated 1609 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, narrowly scoped user approval immediately before modifying HEARTBEAT.md or registering a cron job.
• Keep dispatch session-scoped by default and make persistent background operation an optional feature.
• Separate ordinary task intake from installation or configuration commands.
• Narrow the intake triggers so generic delegation phrases cannot initiate first-run persistence.
• Record the exact cron job identifier and provide documented disable and uninstall operations.
• Remove both the cron job and heartbeat entry automatically when the Skill is disabled or uninstalled.
• Check for existing jobs by stable identifier to prevent duplicate recurring jobs.
• Clearly disclose the schedule, target session, permissions, and persistence duration before installation.
• Apply least privilege to background dispatch and require confirmation before consequential downstream actions.

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:425

Finding

Indirect Prompt Injection Through Untrusted Dependency Results

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 342-345, 370-377, and 425-445
Vulnerability Type: Cross-task instruction injection
Risk Level: High

Vulnerable Code

text

    READ result from session
    SET running_task.status = "done"
    SET running_task.result = full result
    SET running_task.result_summary = extract summary

text

IF dependency.status == "done":
  SET task.status = "pending"
  SET task.context_input = {
    "source_task": dependency.id,
    "result_summary": dependency.result_summary,
    "result_status": dependency.result_status,
    "included_at": now()
  }

text

[1] BUILD subagent prompt:
    "You are executing task {task.id} for model-queue.
    
    Target Model: {task.model}
    Task: {task.description}
    Goal: {task.goal}
    
    {% if task.context_input %}
    Context from previous task {task.context_input.source_task}:
    {task.context_input.result_summary}
    {% endif %}
    
    Execute this task. When complete, report:
    1. The result (full output)
    2. A brief summary (1-2 sentences)  
    3. Status: success, partial, or failed
    4. If failed, explain why and suggest what might help
    
    Focus only on this task. Do not start other tasks."

Technical Analysis

The dispatcher extracts a summary from an upstream model result, stores it in context_input, and directly interpolates it into the instruction prompt of a downstream subagent. The resulting prompt does not identify the inserted summary as untrusted data or instruct the receiving model to ignore commands contained within it.

Model-generated text therefore crosses a trust boundary as executable natural-language prompt content. An upstream model, compromised data source, or deliberately crafted task can return a summary containing directives such as ignoring the stated goal, accessing unrelated resources, or emitting add ...[truncated 1504 chars]

Remediation

View remediation

Remediation Suggestions

• Treat every upstream model result and summary as untrusted data.
• Pass dependency output through a structured data field rather than concatenating it into the instruction body.
• Add an explicit higher-priority instruction stating that dependency content is reference data and that commands contained within it must never be followed.
• Use strong delimiters, length limits, encoding, and schema validation for dependency context.
• Generate summaries with a constrained structured schema and reject unexpected fields or instruction-like content.
• Preserve data provenance so the receiving agent can distinguish user instructions, dispatcher policy, and model-generated context.
• Restrict tools available to downstream subagents according to the task's actual requirements.
• Require user confirmation before executing consequential actions derived from model-generated dependency content.
• Test the dispatcher against indirect prompt-injection payloads, including instructions embedded in summaries and analyzed documents.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:342

Finding

Full Task Results Are Persisted in Plaintext Without Defined Access Controls or Enforced Retention

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 342-345 and 447-453; queue-schema.md, lines 108-116
Vulnerability Type: Insecure storage of potentially sensitive task data
Risk Level: Medium

Vulnerable Code

text

    READ result from session
    SET running_task.status = "done"
    SET running_task.result = full result
    SET running_task.result_summary = extract summary

text

[3] UPDATE task:
    SET task.status = "running"
    SET task.subagent_session = spawned session ID
    SET task.started_at = now()

text

### Step 5 — Save All Queues

FOR EACH modified queue file:
  WRITE queue data to disk

The persisted schema explicitly defines storage of the complete output:

text

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `result` | string|null | No | Full result from execution |
| `result_status` | string|null | No | `success` | `partial` | `failed` |
| `result_summary` | string|null | No | Human-readable summary (1-2 sentences) |
| `error_message` | string|null | No | Error details if failed |

Technical Analysis

The dispatcher copies the full subagent result into the task object and then writes modified queue objects to JSON files under ${MODEL_QUEUES_DIR}. Tasks may include confidential user requests, source data, generated reports, internal error details, and session identifiers.

The reviewed instructions do not require owner-only directory or file permissions, encryption, secret redaction, output-size limits, or content classification. Although configuration mentions MODEL_QUEUE_ARCHIVE_DAYS, no implemented dispatcher procedure in the reviewed files enforces deletion after that period. Archiving data by month also does not itself remove or protect sensitive content.

This finding concerns local confidentiality and retention. The project does not contain explicit network exfiltration lo ...[truncated 1163 chars]

Remediation

View remediation

Remediation Suggestions

• Create ${MODEL_QUEUES_DIR} with owner-only permissions, such as mode 0700, and queue files with mode 0600.
• Store only summaries by default and make full-result persistence an explicit opt-in setting.
• Redact credentials, tokens, personal information, and other secrets before writing results or errors.
• Implement and test actual retention deletion based on MODEL_QUEUE_ARCHIVE_DAYS.
• Provide per-task deletion and secure purge operations.
• Enforce maximum field and queue-file sizes to prevent unbounded sensitive-data retention.
• Encrypt sensitive queue data at rest using a properly managed key when persistent full outputs are required.
• Avoid persisting session identifiers unless needed for active execution, and remove them after completion.
• Document the storage location, permissions, retention period, backup implications, and sensitivity limitations to users.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The INTAKE activation patterns are broad enough to match ordinary conversational requests such as 'do this for me' or 'handle this', which can cause the skill to enter task-creation mode unexpectedly. In this skill's context, accidental activation is more dangerous because INTAKE immediately proceeds to first-run setup and dispatcher execution, potentially causing file writes, queue mutations, and downstream task dispatch without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

On first run, the skill automatically creates directories and queue files, edits HEARTBEAT.md, and registers a cron job, yet the skill description does not prominently warn that it will persist changes and schedule background execution. This is dangerous because a user may invoke the skill for simple task routing but unknowingly grant it ongoing persistence and automatic execution behavior, increasing the blast radius of accidental or malicious task intake.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list contains broad, natural phrases such as 'do this for me', 'handle this', and 'send to', which can cause the skill to activate during ordinary conversation rather than through an explicit task-queueing intent. In this skill's context, unintended activation is more dangerous because activation can lead to queue creation, file writes, heartbeat updates, cron registration, and later subagent dispatching, creating real side effects from ambiguous user input.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest grants filesystem writes, HEARTBEAT.md modification, cron registration, and subagent spawning, but the skill does not clearly present these behaviors as user-visible consented side effects at execution time. This is risky because a user may invoke what appears to be a simple task-management feature while unknowingly authorizing persistent system changes and autonomous execution pathways.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The manifest includes a Chinese regex-like trigger and all user examples are written in Chinese, but it does not state that the skill is region-specific or provide an explicit language opt-in. This can amount to a locale expectation embedded in the skill's natural-language interface without user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.