OGT Docs Create Task

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:14 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent task-management guide, but its shell-command examples use unvalidated placeholders that could lead an agent to run unsafe file operations if copied directly.

Review this skill before installing if agents will create tasks from untrusted requests. Use strict slug and agent-name allowlists, quote shell variables, add -- before path operands where supported, and ensure all resolved paths remain under docs/todo/. There is no evidence of malicious intent, remote payloads, credential access, or persistence beyond task files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:762

Finding

Unvalidated Placeholders in Shell Commands

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 762–827
Vulnerability Type: Command injection, argument injection, and path traversal
Risk Level: Medium

Vulnerable Code

bash

# Move from pending to in_progress
mv docs/todo/pending/{task_slug} docs/todo/in_progress/

# Add assignment signal
touch docs/todo/in_progress/{task_slug}/.assigned_to_{agent}

# Add start timestamp
echo "$(date -Iseconds)" > docs/todo/in_progress/{task_slug}/.started_at

# Create progress log
touch docs/todo/in_progress/{task_slug}/progress.md

# Move to blocked
mv docs/todo/in_progress/{task_slug} docs/todo/blocked/

# Add blocked signals
touch docs/todo/blocked/{task_slug}/.blocked
echo "Reason here" > docs/todo/blocked/{task_slug}/.blocked_reason
echo "$(date -Iseconds)" > docs/todo/blocked/{task_slug}/.blocked_at

# Move to review
mv docs/todo/in_progress/{task_slug} docs/todo/review/

# Add review signals
touch docs/todo/review/{task_slug}/.ready_for_review
echo "$(date -Iseconds)" > docs/todo/review/{task_slug}/.review_requested_at

# Move to done
mv docs/todo/review/{task_slug} docs/todo/done/

# Add completion signals
touch docs/todo/done/{task_slug}/.verified
echo "$(date -Iseconds)" > docs/todo/done/{task_slug}/.completed_at
touch docs/todo/done/{task_slug}/.verified_by_{agent}

# Move to rejected
mv docs/todo/review/{task_slug} docs/todo/rejected/

# Add rejection signals
touch docs/todo/rejected/{task_slug}/.rejected
echo "Reason here" > docs/todo/rejected/{task_slug}/.rejected_reason
echo "$(date -Iseconds)" > docs/todo/rejected/{task_slug}/.rejected_at

Technical Analysis

The Skill directs an agent to interpolate {task_slug} and {agent} into shell commands without quoting or validation. If either value is derived from untrusted input and substituted verbatim, shell metacharacters may introduce additional commands, whitespace may split one intended path into several arguments, and a leading hyphen may be interpreted as a command-lin ...[truncated 1879 chars]

Remediation

View remediation

Remediation Suggestions

1. Validate every task slug and agent identifier before using it in a command. Apply a strict allowlist, such as:

   bash

   validate_identifier() {
     [[ "$1" =~ ^[a-z0-9][a-z0-9_-]{0,63}$ ]]
   }
   
   validate_identifier "$task_slug" || {
     printf '%s\n' "Invalid task slug" >&2
     exit 1
   }
   

2. Quote all variable expansions so each validated value remains one shell argument:

   bash

   mv -- "docs/todo/pending/$task_slug" "docs/todo/in_progress/"
   touch -- "docs/todo/in_progress/$task_slug/.assigned_to_$agent"
   

3. Use -- before path operands where supported to prevent identifiers beginning with a hyphen from being interpreted as options.

4. Reject absolute paths, directory separators, . and .. path components, control characters, whitespace, and shell metacharacters.

5. Resolve and verify constructed paths before modification. Confirm that the canonical source and destination remain beneath the expected docs/todo/ root.

6. Prefer a dedicated lifecycle-management script or structured filesystem API over commands assembled from textual placeholders. The script should validate inputs centrally, check expected source and destination stages, and fail safely if a target already exists.

7. Update every lifecycle example in SKILL.md to demonstrate validated variables and quoted path handling, preventing agents from copying the unsafe pattern.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 911)May include surrounding context.

md

## Verification Rules

**NEVER mark a task as done without verification.**

### Verification Checklist

Static analysis

No suspicious patterns detected.