ClawHub
Back to skill

Security audit

Cognary Tasks is an AI-first task manager that turns your spoken thoughts into organized, actionable tasks instantly. Just speak naturally, and Cognary uses AI to prioritize, structure, and manage your to-dos for you. Less effort, more focus — productivity built for the AI era.

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Cognary task-management helper, with normal care needed for its API key and delete command.

Before installing, confirm that cognary-cli is the intended package, use a dedicated or revocable Cognary API key if possible, and ask the agent to show the exact task title and ID before updating or deleting tasks.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill advertises that it should trigger on essentially any request about tasks, to-dos, reminders-as-tasks, or action items, which is broader than necessary for a capability that can mutate and delete user data. Overly broad invocation increases the chance the agent will route ambiguous user requests into this skill and perform unintended task operations, especially because the skill includes create, update, complete, and delete actions.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The documentation exposes a delete command for tasks but provides no warning that deletion is destructive or guidance to confirm intent before executing it. In an agent context, this omission makes accidental or ambiguous destructive actions more likely, because the skill normalizes deletion as a routine action without safety guardrails.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.