Little Steve Task Manager

• Analyzed: May 18, 2026, 6:18 AM
• Findings: 1
• Version: 0.1.7
• Hash: 8e8fcd74b722c0df64840e2475356d5e332f3b71c89014fccb7b278888d1fd4c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a functional task manager with well-structured bash scripts and proper input validation using jq. However, the 'data/tasks.json' file contains a pre-populated task (ID 12) with a title set to a destructive shell command payload: '$(rm -rf /)'. While the 'scripts/task.sh' script handles this string safely and does not execute it, the inclusion of such a payload in the default data acts as a prompt-injection lure designed to trick an AI agent into executing the command if it interprets the task content as a direct instruction.