Cognary Tasks is an AI-first task manager that turns your spoken thoughts into organized, actionable tasks instantly. Just speak naturally, and Cognary uses AI to prioritize, structure, and manage your to-dos for you. Less effort, more focus — productivity built for the AI era.

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:50 AM UTC
• Version: 1.0.0

Overview

This task-management skill is coherent, but it needs review because it can install an unpinned global CLI, use an API key, and mutate or delete external tasks with weak safeguards.

Review before installing. Use this only if you intend the agent to manage your Cognary tasks, install the CLI from a version and publisher you trust, configure `COGNARY_API_KEY` through a local secret mechanism rather than chat, and require explicit confirmation before updates or deletes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:10
• Finding: Unpinned Global Installation of a Third-Party Package## Vulnerability Details **File Location**: `SKILL.md`, lines 10-16 **Vulnerability Type**: Supply-chain exposure through an unpinned npm dependency **Risk Level**: High ### Vulnerable Code ```markdown ## Installation If `cognary-cli` is not installed, install it first: ```bash npm install -g cognary-cli ``` ``` ### Technical Analysis The Skill instructs the agent to install `cognary-cli` globally from the npm registry without pinning a reviewed version or validating package integrity. This resolves to whichever version and associated lifecycle scripts the registry serves at installation time. Consequently, the package executed in the future may differ from the package that existed when the Skill was audited. A global npm installation may execute package lifecycle scripts with the permissions of the user running the agent. The instruction does not require publisher verification, an integrity hash, a lockfile, an isolated environment, or explicit approval immediately before installation. This is a supply-chain weakness rather than evidence that the current `cognary-cli` package is malicious. Exploitation depends on a compromised publisher account, registry compromise, malicious future release, or similarly unsafe package-source event. ### Attack Path 1. The Skill is invoked on a system where `cognary-cli` is absent. 2. An agent follows the installation instruction. 3. npm resolves the unpinned package name to the latest available release. 4. A compromised or malicious release is downloaded. 5. npm executes any applicable package installation lifecycle scripts. 6. The package or its scripts perform attacker-controlled actions with the invoking user's permissions. ### Impact Assessment Successful exploitation could allow arbitrary code execution under the account running npm. Potential scope includes reading or modifying files accessible to that account, accessing environment variables such as `COGNARY_API ...[truncated 318 chars]
• Remediation: ## Remediation Suggestions - Pin `cognary-cli` to a specifically reviewed version rather than installing the latest release implicitly. - Verify the package publisher, source repository, release provenance, and npm integrity metadata. - Prefer a project-local dependency governed by a lockfile instead of a global installation. - Disable lifecycle scripts during installation where compatible with the package's operation. - Run the CLI in a restricted environment with minimal filesystem, environment-variable, and network access. - Require explicit user approval before installing software or executing package lifecycle scripts. - Establish a controlled update process that re-reviews new package versions before changing the pin.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:18
• Finding: Unsafe API-Key Disclosure and Configuration Guidance## Vulnerability Details **File Location**: `SKILL.md`, lines 18-24 **Vulnerability Type**: Insecure handling of authentication credentials **Risk Level**: Medium ### Vulnerable Code ```markdown ## Auth The `COGNARY_API_KEY` env var must be set. If calls fail with an auth error, tell the user: - If they don't have an account or API key, they can register at **https://tasks.cognary.ai** - Once in the app, go to the **Settings** menu and select **"MANAGE API KEYS"** to create a new key - Then provide the key so it can be configured ``` ### Technical Analysis The instruction tells the user to “provide the key” without defining a secure credential-transfer or configuration mechanism. It does not prohibit sending the key through the conversation, require redaction, specify secure secret storage, or warn against exposing it in command history and logs. If interpreted as a request to paste the credential into chat, the API key may be retained in conversation records, telemetry, debugging output, or other logs. The Skill requires the credential in an environment variable but provides no controls for preventing accidental disclosure when setting, troubleshooting, or invoking the CLI. No hardcoded credential is present in the project, and the file does not itself exfiltrate the key. The weakness is the unsafe instruction that can cause a user to disclose a live secret. ### Attack Path 1. A Cognary CLI request fails because authentication is not configured. 2. The agent follows the Skill and asks the user to create and provide an API key. 3. The user pastes the live key into the conversation or another logged input channel. 4. The credential is retained in conversation history, application telemetry, support logs, or copied command history. 5. A party with access to those records obtains the key. 6. The exposed key is used against Cognary services until it is revoked or expires. ### Impact Assessment The privilege ...[truncated 549 chars]
• Remediation: ## Remediation Suggestions - Replace the instruction to “provide the key” with directions for users to configure `COGNARY_API_KEY` themselves through an approved secret manager or protected local environment. - Explicitly state that API keys must never be pasted into chat, included in task content, echoed in responses, or committed to files. - Provide platform-appropriate secure configuration guidance without printing the secret to the terminal or retaining it in shell history. - Ensure diagnostic output and CLI errors redact credentials. - Use short-lived, narrowly scoped API keys where supported. - Document key rotation and immediate revocation procedures for suspected exposure. - Restrict the agent process so unrelated tools and subprocesses cannot read the credential from its environment.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger description is broad enough to activate on many ordinary requests about tasks, to-dos, reminders, or action items, which increases the chance the skill is invoked when the user did not explicitly intend to use this external task service. In this skill, unintended invocation matters because it can lead to external API calls and state-changing operations on a user's task list, not just harmless read-only assistance.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill documents deletion as a normal command but provides no warning that it is destructive or guidance to confirm intent before executing it. In a task-management context, accidental deletion can permanently remove user data or workflow context, especially if the CLI or backend lacks an undo mechanism.

Static analysis

No suspicious patterns detected.