Security audit

tick-md

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed local task-coordination skill; it can change and delete project task records, but those powers fit its stated purpose and are not hidden.

Install only if you trust the tick-md and tick-mcp-server npm packages and want agents to maintain a project TICK.md file. Require explicit approval before MCP config changes, Git pushes, deletes, force deletes, direct edits, and non-dry-run undo; avoid putting secrets in task comments.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The reference explicitly documents `tick_edit` as a way to bypass state-machine validation, which undermines the integrity guarantees implied by the rest of the coordination workflow. In an agent-operated environment, this can let an agent place tasks into impossible or unsafe states, alter dependencies, or falsify project status without normal guardrails.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill exposes a cluster of destructive/admin capabilities (`tick_delete`, `tick_edit`, `tick_undo`) without any stated authorization model or narrow operational scope. In isolation these may be legitimate maintenance features, but in an agent skill they materially increase the blast radius of mistakes or misuse by allowing deletion, history reversion, and integrity bypass.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill explicitly encourages automatic task creation from broad natural-language requests (for example, turning a casual user request into state-changing operations without a confirmation step). That increases the chance of unintended writes to project coordination files and can be abused through ambiguous or indirect prompts to trigger actions the user did not clearly authorize.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill documents destructive deletion commands, including forced deletion, without requiring confirmation or prominently warning about task/data loss. In an agent context, this can normalize or enable irreversible destructive operations from user prompts or misinterpretation, especially because the skill otherwise promotes transparent autonomous task maintenance.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: `tick_delete` is a destructive operation, and the documentation presents it as routine usage without caution about data loss, dependent-task breakage, or when `force` should be avoided. That makes accidental misuse by agents or operators more likely, especially in automated flows.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The direct-edit operation is documented as bypassing validation but lacks strong safety framing, which normalizes use of an integrity-breaking mechanism. In a multi-agent coordination system, that can lead to silent corruption of task state, broken dependency graphs, and misleading status information.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: `tick_undo` reverts the most recent tick commit, which may have broader side effects than a user or agent expects, yet the documentation does not warn about scope, race conditions, or collaboration risks. In shared workflows, an automated undo could revert another actor's changes and destabilize project history.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.