T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/todo_manager.py:18- Finding
Undisclosed Access to a Hard-Coded File Outside the Skill Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
Task Memory
Security checks for vulnerabilities and agentic risk
Overview
This task-memory skill mostly does what it claims, but it silently reads and writes a hard-coded todo file outside the skill directory and includes under-scoped external reminder instructions.
Review before installing. Use this only if you are comfortable with a task manager that stores task titles, notes, and deadlines on disk, and fix or configure the storage path before running it so it cannot read or modify another workspace's todo file. Do not enable QQ/IM reminder forwarding without explicit destination controls and redaction for sensitive task text.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/todo_manager.py:25- Finding
Non-Atomic and Unlocked Task Database Writes
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/todo_manager.py:243- Finding
Task Updates Bypass Deadline and Status Validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill clearly instructs the agent to create and update a persistent
references/todo.json, which is a file-write capability, but the manifest does not declare any explicit tool scope or permissions. This creates an authorization ambiguity where a host may grant broader filesystem access than intended, making accidental or unsafe writes more likely.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs persistent storage of task data in
todo.jsonbut does not warn that user-provided task details will be written to disk. This can surprise users and operators, and may expose sensitive plans, notes, or deadlines through local file access, backups, or logs.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill is described as a local task-memory system, but the documentation also directs pushing overdue reminders to external QQ/IM channels. That expands the data flow from local persistence into outbound messaging without corresponding scope, consent, or security controls, increasing the chance of task data leakage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation tells the agent to push overdue task reminders to QQ/IM but provides no privacy warning, consent requirement, or guidance on minimizing sensitive content. Since task titles and notes may contain personal, financial, or operational details, this can lead to inadvertent disclosure to third-party channels.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The AGENTS/HEARTBEAT integration instructions operationalize external QQ/IM reminder delivery even though the skill's stated purpose is local todo tracking. Embedding this in startup and heartbeat flows increases the likelihood of automatic, repeated disclosure of potentially sensitive task details to external channels.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file documents that completed tasks are automatically archived and that a purge command deletes archived items older than 30 days. Those behaviors affect user data retention and deletion, but the document provides no warning or caution about these impacts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language strings that effectively force a specific language for usage instructions and operational output. Under the policy, locale-specific behavior should either offer user opt-in/choice or be clearly justified as region-specific, which is not present here.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The docstring at L144 says archived items are '保留30天' and the output at L160-L164 presents the archive as retained for 30 days, but completed tasks are actually archived indefinitely in todo.json until the separate --purge command is run. This is an active contradiction about lifecycle behavior, not just missing detail, because the code only filters display to 30 days and does not enforce automatic deletion.
- Content