Security audit

wip

Security checks across malware telemetry and agentic risk

Overview

This task-tracking skill is mostly transparent, but it should be reviewed because it can automatically delete task records and run external status checks without asking first.

Review this skill before installing if your task list may contain sensitive project details, PRs, deployments, or remote systems. It is not malicious from the inspected artifacts, but users should be comfortable with automatic cleanup of task records and automatic status-check commands, or require a modified version that previews deletion targets and asks before gh/curl/ssh checks.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The hook injects a system reminder directing the agent to delete tasks when completion-related keywords are detected, which can cause state-destructive actions from loosely inferred user intent rather than an explicit completion workflow. In a progress-tracking skill, deleting records instead of marking them completed or asking for confirmation can erase work history and cause incorrect task state transitions.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The inline comment explicitly states the hook should inject a reminder to 'verify + delete the task,' showing the unsafe behavior is intentional in the implementation design rather than an incidental mismatch. That documentation can reinforce and perpetuate unsafe maintenance decisions that encourage destructive handling of possibly completed tasks.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: Broad trigger phrases like 'resume task' or 'cleanup + resume' can cause the skill to activate in contexts where the user did not intend stateful task management. In this skill, activation may lead to task cleanup, registration, or deletion workflows, so accidental invocation can modify task state or steer the assistant away from the user's immediate objective.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The 'When to Use' section includes subjective conditions such as 'large task instruction' or 'when you want to record/preserve the current state,' which can lead to over-activation and unintended state changes. Because this skill includes cleanup and task-registration behavior, ambiguous invocation criteria increase the risk of modifying tracking artifacts without sufficiently clear user intent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill authorizes immediate deletion of stale completed/in-progress entries with no user confirmation required, which is a state-changing operation on user work records. Even if intended as cleanup, doing this without upfront warning or confirmation can cause loss of context, accidental removal of still-useful tasks, and incorrect recovery after compaction or inherited sessions.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The skill directs the agent to write conversation-derived questions and task state into persistent paths under <appDataDir>/brain/<conversation-id> without any warning about retention or sensitivity. In a progress-tracking skill, those artifacts can easily contain user work details, internal plans, identifiers, or other sensitive context, creating avoidable privacy and data-handling risk if storage is later exposed or reused.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script uses broad keyword matching like 'done', 'completed', and 'handled it' to trigger a system reminder that tells the agent to delete tasks, without any required user-facing confirmation. Because these phrases can appear in ambiguous contexts, the hook can push the agent toward unintended destructive updates and loss of task tracking integrity.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The workflow explicitly permits automatic deletion of completed and residual in-progress items without user confirmation. Because this skill operates on persistent task-tracking state across sessions, mistaken classification or unexpected invocation can silently destroy task history or progress metadata, making recovery difficult and potentially hiding unfinished work.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: ### Auto-proceed — verification/lookup tasks need no ask If a task subject contains any of the following keywords, run the action immediately without asking and reflect the result: | Keyword | Auto-run command | |---------|-----------------|
Confidence: 91% confidence
Finding: without asking

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: ### Auto-proceed exception (Claude Code) If a task subject contains only simple **lookup/check keywords**, execute it immediately without asking and reflect the result (see [claude.md](./claude.md) → "Auto-proceed — verification/lookup tasks need no ask"). | Example keyword | Auto-run command | |-----------------|------------------|
Confidence: 89% confidence
Finding: without asking

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.