Taskline Integration

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:08 PM UTC
• Version: 2.0.0

Overview

This skill is a real MyTaskline task-management integration, but it stores a full-access API key in a local config file and can automatically change live account data from parsed text without a confirmation step.

Review this before installing if the connected MyTaskline account contains sensitive work data. Use a test account first, avoid storing a real API key in a shared or committed skill directory, keep the configured endpoint on the official HTTPS MyTaskline API, and expect natural-language commands to create or update live tasks, projects, and people records without a separate confirmation prompt.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/config.json:2

Finding

Plaintext API key can be transmitted to an untrusted configurable endpoint

Content

View full analysis

Vulnerability Details

File Location: references/config.json:2-3, INSTALL.md:29-35, scripts/create_task_enhanced.py:25-34
Vulnerability Type: Plaintext credential storage and insufficient endpoint validation
Risk Level: Medium

The same configuration and request pattern is also used by scripts/create_task.py, scripts/create_task_smart.py, scripts/list_tasks.py, scripts/reports.py, and scripts/update_task.py.

Vulnerable Code

references/config.json:1-5:

json

{
  "baseUrl": "https://mytaskline.com/api/v1",
  "apiKey": "YOUR_MYTASKLINE_API_KEY_HERE",
  "timezone": "America/Denver"
}

INSTALL.md:29-38:

markdown

1. Open `references/config.json` in the skill directory
2. Replace the placeholder with your actual API key:

```json
{
  "baseUrl": "https://mytaskline.com/api/v1",
  "apiKey": "your-actual-api-key-here",
  "timezone": "America/Denver"
}

text

`scripts/create_task_enhanced.py:25-34`:

```python
config = load_config()

headers = {"X-API-Key": config["apiKey"]}
if data:
    headers["Content-Type"] = "application/json"

url = f"{config['baseUrl']}/{endpoint.lstrip('/')}"

if method == "GET":
    response = requests.get(url, headers=headers)

Technical Analysis

Installation explicitly instructs users to save a full-access API key in a plaintext file inside the project directory. This can expose the credential through accidental source-control commits, backups, archive sharing, permissive filesystem permissions, or access by another local process or user.

The request implementation also trusts the configured baseUrl without verifying its scheme or hostname. The API key is attached to requests made to that URL. If the configuration is modified to reference an attacker-controlled server or an unencrypted HTTP endpoint, subsequent operations disclose the key in the X-API-Key header. Query operations may additionally di ...[truncated 1519 chars]

Remediation

View remediation

Remediation Suggestions

1. Read the API key from a protected environment variable or operating-system secret manager rather than a tracked project file.
2. Keep only a non-secret example such as config.example.json in the package.
3. Add the live configuration file and common secret files to .gitignore.
4. Restrict any unavoidable credential file to the owning user, such as mode 0600 on supported systems.
5. Reject placeholder, empty, or malformed keys before making a request.
6. Parse baseUrl and require the https scheme.
7. Allowlist the expected hostname, such as mytaskline.com, unless custom deployments are an intentional feature. If custom endpoints are required, require explicit user confirmation before sending credentials to a new origin.
8. Use separate least-privilege API tokens for read-only reporting and mutating operations if the service supports scoped credentials.
9. Document immediate key revocation and rotation procedures for accidentally committed or shared keys.
10. Avoid printing full server response bodies where they could contain sensitive account or task information.

T08 · Insecure Dependencies

Note

• Location: INSTALL.md:148

Finding

Unpinned third-party dependency installation is not reproducible or integrity-verified

Content

View full analysis

Vulnerability Details

File Location: INSTALL.md:148-150
Vulnerability Type: Unpinned dependency installation
Risk Level: Low

Vulnerable Code

markdown

### **"Module not found: requests"**
- **Issue**: Missing Python requests module
- **Solution**: Install with `pip install requests`

Technical Analysis

The installation command resolves the latest available requests release from the user's active Python package index. The project provides no pinned dependency manifest, lock file, hash verification, or isolated-environment instructions.

Although requests is a legitimate package and there is no evidence that the project intentionally introduces a malicious dependency, this installation process is not reproducible. Its result can change over time and depends on the configured package index. A compromised or incorrectly configured index could supply an unexpected package artifact, while a future incompatible release could alter runtime behavior.

Attack Path

1. A user encounters the documented missing-module error.
2. The user runs pip install requests as instructed.
3. The local pip configuration resolves packages through a compromised, attacker-controlled, or otherwise untrusted index; alternatively, the upstream package or distribution channel is compromised.
4. Because no version or artifact hash is specified, pip accepts the artifact selected by that index.
5. Package installation code executes with the privileges of the user running pip.
6. Malicious package code can then access data available to that user, including the plaintext Taskline configuration if readable.

Impact Assessment

Successful package substitution or upstream compromise could execute arbitrary Python installation code with the privileges used to run pip. Under normal user installation this affects the user's account and readable files. If the command is run with administrative privileges, the impact c ...[truncated 193 chars]

Remediation

View remediation

Remediation Suggestions

1. Declare dependencies in a version-controlled requirements or project metadata file.
2. Pin requests to a reviewed, compatible version or a narrowly controlled version range.
3. For stronger reproducibility, generate a lock file containing hashes and install with hash checking enabled.
4. Document installation inside a dedicated virtual environment rather than the global interpreter.
5. Explicitly use the intended trusted package index and warn against running pip with administrative privileges.
6. Add automated dependency vulnerability and update monitoring so pinned versions can be reviewed and upgraded promptly.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documentation emphasizes general AI task creation and multi-entity management, while the cited behavior suggests only simple status extraction for existing tasks. This mismatch can materially mislead users into sending sensitive operational requests or approving automation with capabilities they do not understand, increasing the chance of accidental data exposure or unintended account actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The documentation emphasizes general AI task creation and multi-entity management, while the cited behavior suggests only simple status extraction for existing tasks. This mismatch can materially mislead users into sending sensitive operational requests or approving automation with capabilities they do not understand, increasing the chance of accidental data exposure or unintended account actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The documentation emphasizes general AI task creation and multi-entity management, while the cited behavior suggests only simple status extraction for existing tasks. This mismatch can materially mislead users into sending sensitive operational requests or approving automation with capabilities they do not understand, increasing the chance of accidental data exposure or unintended account actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documentation emphasizes general AI task creation and multi-entity management, while the cited behavior suggests only simple status extraction for existing tasks. This mismatch can materially mislead users into sending sensitive operational requests or approving automation with capabilities they do not understand, increasing the chance of accidental data exposure or unintended account actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documentation emphasizes general AI task creation and multi-entity management, while the cited behavior suggests only simple status extraction for existing tasks. This mismatch can materially mislead users into sending sensitive operational requests or approving automation with capabilities they do not understand, increasing the chance of accidental data exposure or unintended account actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The documentation emphasizes general AI task creation and multi-entity management, while the cited behavior suggests only simple status extraction for existing tasks. This mismatch can materially mislead users into sending sensitive operational requests or approving automation with capabilities they do not understand, increasing the chance of accidental data exposure or unintended account actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documentation emphasizes general AI task creation and multi-entity management, while the cited behavior suggests only simple status extraction for existing tasks. This mismatch can materially mislead users into sending sensitive operational requests or approving automation with capabilities they do not understand, increasing the chance of accidental data exposure or unintended account actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README instructs users to paste a live API key into a local config file without any guidance on secure credential handling, such as avoiding commits, setting file permissions, or preferring environment variables/secrets management. This can lead to accidental exposure of credentials through source control, shared files, backups, or screenshots, enabling unauthorized access to the user's MyTaskline account and data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README presents multiple example commands that appear ready to run against a real MyTaskline account, including creating tasks, projects, assigning people, and updating task status, but it does not clearly warn that these operations can modify live data. In a skill explicitly designed to perform API-backed task management, this omission increases the likelihood of unintended writes, accidental project/person creation, and confusing or disruptive changes in a production account.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 77% confidence

Finding

The skill advertises executable workflows involving shell commands, file reads, and network access but does not declare an explicit tool scope or permissions boundary. In an agent environment, this can lead to overbroad execution capability, making it harder to enforce least privilege and easier for unexpected code paths to reach the filesystem, shell, or external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill encourages natural-language commands that may create or modify live tasks and projects on an external account, but it does not prominently warn users about these real side effects. In agent-driven environments, lack of side-effect disclosure increases the risk of unintended writes, project sprawl, and unauthorized operational changes from ambiguous prompts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

"Ask Sarah to review the documentation by tomorrow - this is urgent"

Auto project creation

"Add task for NewProductLaunch project: create landing page mockups"

text

### 🎯 **Intelligent Features**

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The setup instructions ask users to place a personal API key into a config file without any guidance on secret handling, storage, rotation, or exclusion from version control. This is dangerous because it strongly increases the chance of credential leakage through committed files, shared workspaces, logs, or backups, enabling unauthorized access to the external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_examples.md (reported line 28)May include surrounding context.

Create Task

bash

curl -X POST http://localhost:5173/api/v1/tasks \
  -H "X-API-Key: API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes broader natural-language task management features including people assignment, project creation, and multi-entity parsing. In this file, the parsing logic only extracts priority and due date, and the API payload only contains task fields such as title, description, priority, and dueAt, with no handling for assignees or project entities.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

This code sends task data to an externally configured endpoint using an API key, which is expected for an integration but still creates a real exfiltration surface if the endpoint is misconfigured or untrusted. In this skill context, natural-language task text can contain sensitive operational data, so outbound transmission to a configurable base URL increases risk beyond a purely local utility.

Content

Scanner excerpt · scripts/create_task.py (reported line 120)May include surrounding context.

python

"Content-Type": "application/json"
    }
    
    response = requests.post(f"{config['baseUrl']}/tasks", json=payload, headers=headers)
    
    if response.status_code == 201:
        return response.json()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The script transmits user-provided task content to a remote service without any explicit user-facing disclosure at runtime. Because task descriptions may contain sensitive business information, names, deadlines, or internal project details, silent transmission can create privacy and data-handling risk, especially in an agent-skill context where users may assume local parsing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script transmits task, project, and person data to a remote service without any explicit notice, preview, or consent workflow. In a skill that parses arbitrary natural-language requests, users may unknowingly send personal names, project names, or sensitive work details to MyTaskline, increasing privacy and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/create_task_enhanced.py (reported line 36)May include surrounding context.

python

if method == "GET":
        response = requests.get(url, headers=headers)
    elif method == "POST":
        response = requests.post(url, json=data, headers=headers)
    elif method == "PATCH":
        response = requests.patch(url, json=data, headers=headers)
    else:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/create_task_smart.py (reported line 37)May include surrounding context.

python

if method == "GET":
        response = requests.get(url, headers=headers)
    elif method == "POST":
        response = requests.post(url, json=data, headers=headers)
    elif method == "PATCH":
        response = requests.patch(url, json=data, headers=headers)
    else:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script performs additional state-changing actions beyond task creation by automatically creating projects and person records when parsing names or project references. In a natural-language automation context, this can cause unintended account and data sprawl, especially because free-form input is treated as authoritative and no confirmation step is required.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code automatically creates new projects based on parsed language with no approval step, which can be triggered by ambiguous or malformed input. This is dangerous because it turns passive parsing into unintended remote mutation, potentially cluttering shared workspaces or causing unauthorized organizational changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script may create person records from names extracted out of natural-language text without prior warning or verification. This can create false identities, expose real names to the service, and modify shared directories or collaboration data based on parser mistakes or manipulated input.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a skill focused on transforming natural-language requests into structured tasks with project creation, assignment, date parsing, and priority detection. This file instead implements report generation and analytics retrieval from /reports/* endpoints, which is a materially different user-facing capability not mentioned in the manifest description.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/taskline_ai.py (reported line 63)May include surrounding context.

python

"""Run an enhanced script with arguments."""
    cmd = ['python3', f'scripts/{script_name}'] + args
    try:
        subprocess.run(cmd, check=True)
    except subprocess.CalledProcessError as e:
        print(f"❌ Script failed with exit code {e.returncode}")
        sys.exit(1)