Security audit

TaskTime CLI

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent task timer skill, but users should know it installs an external npm CLI and saves completed task details to ClawVault by default.

Install this only if you trust the @versatly/tasktime npm package and are comfortable with completed task names, categories, notes, and reports being stored in or synced to ClawVault. Avoid putting secrets, customer data, vulnerability details, or confidential project information in task records unless you have verified the service's privacy, retention, and deletion controls; use --no-vault when a task should not be saved externally.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:7
Finding: Unpinned Globally Installed Third-Party Executable<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 7–12 **Vulnerability Type**: Supply-chain exposure through an unpinned npm dependency **Risk Level**: Medium ### Vulnerable Code Snippet ```yaml requires: bins: [tasktime] install: - id: node kind: node package: "@versatly/tasktime" bins: [tasktime, tt] label: Install TaskTime CLI (npm) ``` The documented installation command at lines 20–22 further confirms that the package is installed globally without a version constraint: ```bash npm install -g @versatly/tasktime ``` ### Technical Analysis The skill depends on the external npm package `@versatly/tasktime` but does not pin an exact version or provide an integrity hash. Consequently, the code installed during a future deployment may differ from the code available when the skill was audited. A global npm installation can also execute package lifecycle scripts and places executable commands in the user's global binary path. The repository contains only `SKILL.md`; it does not contain the dependency's implementation, lockfile, checksum, or vendored source. Therefore, the behavior of the installed CLI and any npm lifecycle scripts cannot be verified from the audited artifact. This finding does not establish that the current package is malicious. It identifies an unsafe and mutable supply-chain trust boundary. ### Attack Path 1. An attacker compromises the npm publisher account, release pipeline, or package distribution process for `@versatly/tasktime`. 2. The attacker publishes a malicious version under the existing package name. 3. A user or agent installs the skill using `npm install -g @versatly/tasktime`. 4. npm resolves the unpinned package to the attacker-controlled release. 5. Malicious lifecycle scripts may execute during installation, or malicious CLI logic may execute when `tasktime` or `tt` is invoked. 6. The payload runs with the privileges of the user performing the installation or invoking the CLI. # ...[truncated 638 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@versatly/tasktime` to an exact, reviewed version rather than relying on the latest compatible release. 2. Verify the package using a trusted lockfile and registry integrity hash. 3. Publish or reference the corresponding auditable source code and build provenance. 4. Prefer a project-local installation over a global installation to reduce system-wide exposure. 5. Where compatible with the package, install with npm lifecycle scripts disabled and explicitly review any required scripts before enabling them. 6. Use a trusted registry, dependency monitoring, signed provenance, and automated alerts for publisher or package changes. 7. Re-audit the package implementation whenever the pinned version is updated. ]]>

other

Warning

Location: SKILL.md:50
Finding: Default External Synchronization of Potentially Sensitive Task Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 50–68 **Vulnerability Type**: Privacy-sensitive external data synchronization **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ### ClawVault Integration **Auto-save on stop (v1.2.0+):** Every completed task is automatically saved to [ClawVault](https://clawvault.dev): ```bash tasktime start "Build API" -c coding # ... do the work ... tasktime stop --notes "Finished in record time" # ✅ Completed: Build API # 🐘 Saved to ClawVault ← automatic! ``` **Manual sync and export:** ```bash tasktime sync # Sync full report to ClawVault tasktime sync --days 30 # Sync last 30 days tasktime export # Export as markdown tasktime stop --no-vault # Skip auto-save for one task ``` ``` ### Technical Analysis The documented behavior automatically saves every completed task to the external ClawVault service when `tasktime stop` is executed. Avoiding transmission requires the user to remember the per-command `--no-vault` opt-out. Task descriptions and notes can contain confidential project names, implementation details, vulnerability information, customer identifiers, internal URLs, or other sensitive operational context. Default external synchronization creates a risk that this information will leave the local environment without sufficiently explicit, per-destination consent. The audited artifact does not include the CLI implementation. Therefore, the precise transmitted fields, destination endpoints, authentication controls, transport security, retention policy, and server-side access controls could not be verified. This finding concerns the explicitly documented default synchronization behavior and does not assert that ClawVault mishandles received information. ### Attack Path 1. A user or agent starts a timer using a task description containing sensitive context. 2. During task completion, the user adds sen ...[truncated 1326 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Make external synchronization opt-in and keep completed tasks local by default. 2. Require explicit informed consent before the first transmission and clearly identify the destination service. 3. Provide a persistent local-only configuration rather than relying solely on the per-command `--no-vault` flag. 4. Display the exact fields and records that will be transmitted before synchronization. 5. Allow users to redact task descriptions, notes, identifiers, URLs, and other sensitive values. 6. Document destination endpoints, authentication requirements, encryption in transit, retention periods, deletion procedures, and server-side access controls. 7. Provide an enterprise policy control that disables all outbound synchronization. 8. Warn users not to include secrets, credentials, regulated data, or confidential customer information in task records. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly advertises automatic saving of completed tasks to ClawVault, which is a form of data transmission/persistence that may include sensitive task descriptions, notes, or project details. Because the skill does not prominently warn users that this happens by default or describe what data is sent and where, an agent or user may unintentionally exfiltrate sensitive operational context into an external memory system.

Static analysis

No suspicious patterns detected.