OGT Docs Create Task

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:14 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent task-management guide, but its shell-command examples use unvalidated placeholders that could lead an agent to run unsafe file operations if copied directly.

Review this skill before installing if agents will create tasks from untrusted requests. Use strict slug and agent-name allowlists, quote shell variables, add -- before path operands where supported, and ensure all resolved paths remain under docs/todo/. There is no evidence of malicious intent, remote payloads, credential access, or persistence beyond task files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:762
• Finding: Unvalidated Placeholders in Shell Commands## Vulnerability Details **File Location**: `SKILL.md`, lines 762–827 **Vulnerability Type**: Command injection, argument injection, and path traversal **Risk Level**: Medium ### Vulnerable Code ```bash # Move from pending to in_progress mv docs/todo/pending/{task_slug} docs/todo/in_progress/ # Add assignment signal touch docs/todo/in_progress/{task_slug}/.assigned_to_{agent} # Add start timestamp echo "$(date -Iseconds)" > docs/todo/in_progress/{task_slug}/.started_at # Create progress log touch docs/todo/in_progress/{task_slug}/progress.md # Move to blocked mv docs/todo/in_progress/{task_slug} docs/todo/blocked/ # Add blocked signals touch docs/todo/blocked/{task_slug}/.blocked echo "Reason here" > docs/todo/blocked/{task_slug}/.blocked_reason echo "$(date -Iseconds)" > docs/todo/blocked/{task_slug}/.blocked_at # Move to review mv docs/todo/in_progress/{task_slug} docs/todo/review/ # Add review signals touch docs/todo/review/{task_slug}/.ready_for_review echo "$(date -Iseconds)" > docs/todo/review/{task_slug}/.review_requested_at # Move to done mv docs/todo/review/{task_slug} docs/todo/done/ # Add completion signals touch docs/todo/done/{task_slug}/.verified echo "$(date -Iseconds)" > docs/todo/done/{task_slug}/.completed_at touch docs/todo/done/{task_slug}/.verified_by_{agent} # Move to rejected mv docs/todo/review/{task_slug} docs/todo/rejected/ # Add rejection signals touch docs/todo/rejected/{task_slug}/.rejected echo "Reason here" > docs/todo/rejected/{task_slug}/.rejected_reason echo "$(date -Iseconds)" > docs/todo/rejected/{task_slug}/.rejected_at ``` ### Technical Analysis The Skill directs an agent to interpolate `{task_slug}` and `{agent}` into shell commands without quoting or validation. If either value is derived from untrusted input and substituted verbatim, shell metacharacters may introduce additional commands, whitespace may split one intended path into several arguments, and a leading hyphen may be interpreted as a command-lin ...[truncated 1879 chars]
• Remediation: ## Remediation Suggestions 1. Validate every task slug and agent identifier before using it in a command. Apply a strict allowlist, such as: ```bash validate_identifier() { [[ "$1" =~ ^[a-z0-9][a-z0-9_-]{0,63}$ ]] } validate_identifier "$task_slug" || { printf '%s\n' "Invalid task slug" >&2 exit 1 } ``` 2. Quote all variable expansions so each validated value remains one shell argument: ```bash mv -- "docs/todo/pending/$task_slug" "docs/todo/in_progress/" touch -- "docs/todo/in_progress/$task_slug/.assigned_to_$agent" ``` 3. Use `--` before path operands where supported to prevent identifiers beginning with a hyphen from being interpreted as options. 4. Reject absolute paths, directory separators, `.` and `..` path components, control characters, whitespace, and shell metacharacters. 5. Resolve and verify constructed paths before modification. Confirm that the canonical source and destination remain beneath the expected `docs/todo/` root. 6. Prefer a dedicated lifecycle-management script or structured filesystem API over commands assembled from textual placeholders. The script should validate inputs centrally, check expected source and destination stages, and fail safely if a target already exists. 7. Update every lifecycle example in `SKILL.md` to demonstrate validated variables and quoted path handling, preventing agents from copying the unsafe pattern.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Verification Rules

**NEVER mark a task as done without verification.**

### Verification Checklist

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.