Task Finish Contract

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:25 AM UTC
• Version: 1.0.0

Overview

This is a process-oriented skill for tracking task completion, with one local privacy-check command that users should run carefully because it can print secrets.

Installers should treat this as a broad workflow habit, not a narrow domain tool. If using the privacy checklist, configure scans to show only filenames or redacted matches, and do not include raw secret-scan output in task logs, memory files, or completion evidence.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/privacy-checklist.md:12

Finding

Privacy Scan May Disclose Complete Credential-Bearing Lines

Content

View full analysis

Vulnerability Details

File Location: references/privacy-checklist.md, lines 12–14
Vulnerability Type: Sensitive information exposure through unredacted scan output
Risk Level: Medium

Vulnerable Code:

powershell

Get-ChildItem . -Recurse -File | Select-String -Pattern 'apiKey|token|secret|password' -CaseSensitive:$false

Technical Analysis

The documented PowerShell command recursively searches project files for credential-related terms. By default, Select-String outputs each complete matching line, including its contents. If a line contains an actual API key, token, secret, or password, the command can reveal the sensitive value instead of merely identifying the affected file.

Because this skill requires execution evidence for multi-step tasks, raw command results could subsequently enter agent context, terminal transcripts, task logs, or completion artifacts. The scan is recursive and does not exclude credential stores, generated files, or other sensitive locations under the working directory.

Attack Path

1. A project file contains a plaintext credential on a line that includes apiKey, token, secret, or password.
2. A user or agent follows the privacy checklist and executes the documented recursive scan.
3. Select-String prints the complete matching line, including the credential value.
4. The output is retained in terminal history, agent context, logs, or completion evidence.
5. A party with access to those records can recover and misuse the exposed credential.

Impact Assessment

The command does not itself grant elevated system privileges or transmit data over a network. Its direct impact is local disclosure of any secrets discoverable beneath the scanned directory. The effective privileges and scope available to an attacker depend on the exposed credential and may include access to associated APIs, services, repositories, or accounts. The audit found no automatic exf ...[truncated 20 chars]

Remediation

View remediation

Remediation Suggestions

• Do not print complete matching lines. Emit only file paths and line numbers, or explicitly redact matched values before displaying results.
• Use a scanner designed for secret detection that masks values by default.
• Exclude known credential stores, generated output, version-control metadata, and other sensitive directories from recursive scans.
• Do not copy raw secret-scan output into agent responses, logs, completion evidence, or persistent artifacts.
• Restrict access to scan logs and remove any existing records that contain credentials.
• If a credential has already appeared in output, revoke or rotate it and review relevant service logs for misuse.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger section says to use the skill when 'Starting any multi-step task,' 'Resuming after interruption,' or 'Handoff to another agent,' which are generic situations that apply to many everyday workflows. It does not define boundaries, exclusions, or concrete examples of when the contract should not be invoked, making unintended invocation likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.