Long-term Task Progress Manager

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:09 AM UTC
• Version: 2.1.0

Overview

This progress-management skill is not malicious, but it needs review because it can automatically monitor workspace files and persist project context without enough user control.

Review before installing. Use this only if you want persistent, cross-session progress files. Prefer explicit commands like checkpoint or mark_milestone, disable or tightly scope automatic file watching, keep logs and secret-bearing JSON/YAML files out of monitored paths, review PROGRESS.md and MEMORY.md before sharing with other agents, and pin third-party dependencies in an isolated environment.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:177

Finding

Overbroad Background Workspace Monitoring Without Explicit User Awareness

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:177-184 and SKILL.md:252-257
Vulnerability Type: Overbroad background file access and collection
Risk Level: Medium

Vulnerable Snippets

markdown

**Trigger**: Detection of `HEARTBEAT.md` changes + time threshold exceeded

**Action**:
1. Monitor HEARTBEAT.md for updates (background service behavior)
2. When heartbeat updates but PROGRESS.md hasn't been synced for a while:
   - Read current workspace state (last modified files, recent error logs)
   - Record `[Auto-Sync]` snapshot in `PROGRESS.md`
3. **Advantage**: Prevents progress loss without user awareness, saves token consumption

markdown

**File Watcher Behavior**:
- Monitor: `.`, `*.md`, `*.json`, `*.yaml` in project directory
- Trigger: Any file change → check if PROGRESS.md needs update
- Debounce: Wait 2 seconds after last change to batch updates
- Filter: Ignore `.git/`, `node_modules/`, `__pycache__/`

Technical Analysis

The skill directs the agent or background service to monitor broad classes of files and inspect recent error logs. The monitored scope includes all Markdown, JSON, and YAML files in the project directory rather than only files owned by LTPM.

These formats commonly contain credentials, API configuration, deployment metadata, internal notes, and other information unrelated to progress tracking. Error logs can likewise contain tokens, request data, filesystem paths, or user-provided content. The instruction that this collection occurs “without user awareness” compounds the least-privilege concern because users may not know which information is being inspected or persisted.

The skill does not define secret filtering, content minimization, access boundaries, user confirmation, or a prohibition against copying sensitive values into PROGRESS.md or MEMORY.md.

Attack Path

1. A project contains sensitive information in a monitored Markdown, JSON ...[truncated 1365 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict automatic monitoring to explicitly owned files:
   • MISSION.md
   • PROGRESS.md
   • NEXT_STEPS.md
   • .ltpm/config.json
2. Do not read error logs or unrelated workspace files during automatic synchronization.
3. Replace “without user awareness” behavior with explicit, informed opt-in.
4. Display the monitored paths and intended destination before enabling background monitoring.
5. Add default exclusions for credentials, secrets, environment files, keys, logs, and deployment configuration.
6. Apply secret detection and redaction before writing snapshots or updating MEMORY.md.
7. Record only metadata required for progress management, such as filenames and modification times, rather than file contents.
8. Require confirmation before expanding monitoring beyond the Core Triad.
9. Keep project progress isolated from global memory unless the user explicitly authorizes synchronization.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:708

Finding

Unpinned Runtime Installation of a Third-Party Python Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:708
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Low

Vulnerable Snippet

markdown

| **pyyaml** | YAML parsing | `pip install pyyaml` |

Technical Analysis

The installation command resolves and installs whichever pyyaml release is current when the command is executed. It provides no exact version, integrity hash, lock file, or trusted package-index restriction.

As a result, installations are not reproducible and may receive a future incompatible or compromised release. Python package installation can also execute distribution-controlled build or installation behavior, depending on the selected artifact and environment.

The audited instruction names a legitimate package and does not demonstrate dependency confusion or a malicious source. The risk is therefore an unsafe supply-chain practice rather than evidence that the current dependency is malicious.

Attack Path

1. A user follows the documented pip install pyyaml instruction.
2. pip resolves the package using the environment's configured package indexes.
3. The resolver selects the newest compatible release rather than an audited fixed artifact.
4. A compromised index, malicious future release, or tampered distribution supplies unsafe package content.
5. Installation or later import executes the package's code with the privileges of the invoking user or agent.

Exploitation depends on compromise of the dependency source, selected release, or package-index configuration; no such compromise is present in the repository itself.

Impact Assessment

A compromised dependency could execute code with the permissions of the account running pip or the LTPM tooling. Depending on that account's access, this could affect project files, agent-readable data, and the Python environment.

The repository does not instruct users to run the command with adminis ...[truncated 160 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin an audited exact version, for example through a requirements or lock file.
2. Include cryptographic hashes and install with hash verification:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Configure a trusted package index explicitly and avoid untrusted extra indexes.
4. Prefer binary wheels from trusted sources where appropriate to avoid arbitrary local build steps.
5. Install the package in an isolated virtual environment rather than the system Python environment.
6. Add automated dependency vulnerability and integrity scanning.
7. Define a controlled update process so dependency upgrades are reviewed and tested before the pinned version changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The natural-language triggers are extremely generic words like 'start', 'progress', 'end', and their Chinese equivalents, which are likely to appear in ordinary conversation. In an agent skill, this can cause unintended state changes or progress writes without explicit user intent, creating prompt-trigger collisions and enabling accidental or adversarial manipulation of project records.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The natural-language triggers are generic words like "progress," "done," "bye," and common Chinese equivalents that appear in ordinary conversation. This can cause accidental activation of checkpointing, milestone logging, or end-of-session persistence, leading to unintended file writes and retention of potentially sensitive conversational content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The quick-start and command list describe initializing projects, saving progress, and syncing status, but do not clearly warn users that the skill will create directories and update files on disk. This lack of disclosure increases the chance of surprising or unauthorized filesystem modifications, especially when combined with broad natural-language triggers and automated status mechanisms.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The natural-language triggers are extremely generic words such as 'start', 'progress', 'end', and their Chinese equivalents, which are likely to appear in normal conversation unrelated to persistence actions. In a skill that creates and updates on-disk project state, this can cause unintended file writes, state changes, or checkpointing without clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The design philosophy bullets are written in Chinese while the rest of the document is primarily in English, and the trigger section defines both Chinese and English forms without explaining language selection. This can impose an undocumented language expectation rather than offering an explicit user opt-in or justified locale constraint.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger condition is extremely broad: any multi-session project or explicit request for progress management can activate the skill. In an agent environment, ambiguous activation criteria can cause the skill to run unexpectedly, creating or updating tracking files without clear user intent and increasing the chance of unwanted persistence.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The design emphasizes cross-session preservation and multi-agent transfer of project context, summaries, and notes. Without data minimization and consent controls, this increases the chance that sensitive information is replicated into multiple long-lived files and exposed to other agents or future sessions beyond the user's expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill describes passive background monitoring and automatic updates to PROGRESS.md based on heartbeat or file changes, but does not present this as an opt-in behavior with prominent user-facing warnings. Users may not realize their workspace activity is being observed and persisted, which creates consent, privacy, and integrity risks.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The passive snapshot flow explicitly instructs recording workspace state, modified files, and recent error logs into long-term progress documents without user awareness. That can capture secrets, internal paths, proprietary code details, credentials in logs, or sensitive user-provided content and persist them across sessions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The configuration constrains natural-language support to ['en', 'zh-CN'], and the document presents Chinese and English trigger templates as the expected modes of operation. This is a locale/language restriction without any stated opt-in, fallback, or user-selectable language policy, which can conflict with organizational requirements for language choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.