ClawHub
Back to skill

Security audit

Agent Task Manager

Security checks across malware telemetry and agentic risk

Overview

This skill is a transparent local workflow template, but its command wrapper should only be used with trusted commands.

Install this only if you want a local task-orchestration template. Review commands before passing them to cooldown.sh, do not pass user-supplied text into that wrapper as a command, and avoid storing sensitive task data because workflow state remains on disk.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill advertises operational components that read and write local state (`task_state.json`) and perform external actions subject to rate limiting, but it does not declare corresponding permissions. That mismatch can bypass operator expectations and safety controls, especially in an orchestration skill that persists state and may invoke networked actions as part of workflows.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The parser is presented as part of a general-purpose task orchestration skill, but it contains a hard-coded crypto/financial alert workflow for a specific token and specific messaging behavior. This creates a capability/intent mismatch: downstream users or systems may invoke the skill expecting neutral workflow management while actually enabling market-related monitoring and alerting, which can be unsafe in autonomous-agent contexts and may facilitate unauthorized financial signaling or domain-specific behavior not disclosed by the skill contract.

Vague Triggers

Medium
Confidence
76% confidence
Finding
The invocation guidance is very broad (`creating new multi-agent systems`, `improving sequential workflows`, `managing time-bound actions`), which can cause the skill to be selected for many ordinary requests beyond its narrowly intended use. In a skill that coordinates persistent state, dependencies, and external actions, over-triggering increases the chance of unintended file changes or network activity in contexts where the user did not expect those behaviors.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script builds a command string from all remaining arguments and executes it with `eval`, which causes the shell to re-parse the input and allows command injection if any part of the command is influenced by untrusted data. In an agent workflow/orchestration context, task names, parameters, or downstream command fragments may be dynamically assembled, making this substantially more dangerous than a purely manual admin script.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.