Security audit

Smart Tasks

Security checks for vulnerabilities and agentic risk

Overview

This is a transparent task-tracking skill that stores tasks in workspace Markdown files and offers optional reminders and cleanup, with no hidden exfiltration, credential use, or destructive behavior found.

Install only if you want a workspace-level task system that writes to tasks/ and may, if you enable the optional pieces, add scheduled background reminders and persistent task-awareness instructions. Review the cron templates and workspace-integration diffs before approving them, especially if your task files or memory entries contain private context.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The activation criteria are broad and based on common natural-language mentions of tasks, deadlines, or things to do. This can cause the skill to trigger in contexts where the user is merely discussing work abstractly, leading to unintended file reads/writes or unsolicited task creation.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Stating that no special commands are needed makes invocation boundaries ambiguous and increases the likelihood of accidental activation from ordinary conversation. In a write-capable skill, ambiguity is dangerous because it can convert conversational context into persistent workspace changes without clear user authorization.

Natural-Language Policy Violations

Medium

Confidence: 79% confidence
Finding: The trigger examples are entirely in Korean, and the update instructions reference a Korean section name, which suggests the skill may expect or default to a specific language. The file does not offer a language choice or document that the locale constraint is intentional and limited, which can violate language/locale policy expectations.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill claims it does not modify files outside its own directory, yet elsewhere instructs applying integration changes to workspace-wide files such as AGENTS.md, SOUL.md, and HEARTBEAT.md. This mismatch can mislead users or higher-level agents about the skill’s true write scope, weakening trust boundaries and enabling broader-than-expected persistence or behavior changes.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The weekly review template instructs an automated cron job to move files, change task status, and refresh INDEX.md without any explicit warning that it performs write operations. In a task-management skill, users may reasonably expect summaries and reminders, but not unattended modifications to workspace files; this creates risk of unintended data loss, incorrect archival, or silent corruption if the model misclassifies tasks.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The task format template requires section names such as '설명', '배경/맥락', '관련 자료', '메모/진행 기록', and '에이전트 노트'. This imposes a specific language/locale in the reference format, and the file does not indicate that this is optional, user-selectable, or justified as a region-specific standard.

Indirect Prompt Extraction

Medium

Category: System Prompt Leakage
Content: +When the user mentions deadlines, tasks, or things to do, naturally offer to track them. +When reminding about tasks, include relevant context — not just the deadline. +Prioritize suggestions based on deadline urgency, estimated effort, and importance. Use reverse prompting when a suggestion, draft, check, or option would genuinely help. ``` ## HEARTBEAT.md Changes
Confidence: 85% confidence
Finding: Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Context-Inappropriate Capability

Low

Confidence: 87% confidence
Finding: The recommended integration extends the skill into unrelated workspace governance and state files beyond the stated task storage area. Even if presented as optional, this broadens the skill’s operational footprint and can create unexpected coupling, persistence, or policy changes outside the user’s task data.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: The document specifies that task file slugs must be an English summary and that Korean titles should be translated into brief English. This is a natural-language locale constraint presented as a requirement, with no user opt-in or stated region-specific justification.

Static analysis

No suspicious patterns detected.