ClawHub
Back to skill

Security audit

TaskboardAI Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a plausible TaskBoardAI integration, but it can automatically persist full task context and results to a board with broad trigger rules and an unpinned global dependency.

Review before installing. Use only if you are comfortable with task details and final results being stored in TaskBoardAI, and prefer explicit user confirmation plus sanitized summaries instead of full context. Pin and verify the TaskBoardAI package version, and consider running the MCP server with restricted filesystem and environment access.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:21
Finding

Unpinned Globally Installed Executable Dependency

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 21-25
Vulnerability Type: Supply-chain exposure through an unpinned globally installed npm dependency
Risk Level: Medium

Complete Code Snippet:

markdown
### 1. 前置依赖
本技能依赖于 [TaskBoardAI](https://github.com/taskboardai/taskboardai)。请先全局安装：

```bash
npm install -g taskboardai
text

The installed dependency is subsequently used as a locally executed MCP server in `SKILL.md`, lines 20-24:

```xml
<mcp_server>
  <command>node</command>
  <args>
    <arg>/opt/homebrew/lib/node_modules/taskboardai/server/mcp/kanbanMcpServer.js</arg>
  </args>
</mcp_server>

Technical Analysis

The installation command does not specify an exact TaskBoardAI version, lockfile, or package-integrity value. It therefore resolves whatever version the npm registry serves at installation time. The Skill then launches JavaScript from that global package as its MCP server.

The externally installed server implementation is absent from the audited project, which contains only README.md and SKILL.md. Consequently, the effective runtime code cannot be verified from this artifact and may change independently after review. npm installation may also execute package lifecycle scripts under the privileges of the user performing the installation.

No evidence establishes that the current TaskBoardAI package is malicious. The confirmed issue is the unsafe, mutable dependency acquisition and execution model, which creates a supply-chain attack surface.

Attack Path

  1. An attacker compromises the upstream npm package, its publisher account, or a transitive dependency and publishes a malicious version.
  2. A user follows the documented npm install -g taskboardai command, which resolves the malicious version because no exact version or integrity constraint is specified.
  3. Attacker-controlled code runs during an npm lifecycle stage or later when Node launch ...[truncated 862 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin TaskBoardAI to an audited exact version rather than installing the latest available release.
  2. Install the dependency locally instead of globally and commit an appropriate lockfile with integrity metadata.
  3. Use reproducible installation commands such as npm ci against the reviewed lockfile.
  4. Verify package provenance, signatures, checksums, and publisher identity before installation.
  5. Disable npm lifecycle scripts during installation where compatible, then explicitly run only reviewed setup steps.
  6. Vendor or include the reviewed MCP server implementation so its effective behavior is part of the auditable artifact.
  7. Run the MCP server in a sandbox or restricted service account with minimal filesystem, environment-variable, credential, and network access.
  8. Add automated dependency scanning and require security review before updating the pinned version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The trigger allows activation not only on an explicit marker but also whenever the agent 'determines a task needs tracking,' which is subjective and overly broad. That increases the chance of unintended skill invocation and automatic exfiltration of conversation content into the task system without a clear user request.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The English version repeats the same broad trigger condition, allowing the agent to invoke the skill whenever it thinks tracking is useful rather than when the user explicitly requests it. In a task-management integration, that materially raises the risk of silent action-taking and unintended disclosure to the board backend.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README presents the skill as an automation convenience but does not disclose that user task text, contextual details, and possibly final results may be written to an external TaskBoard system. This creates a meaningful data disclosure and consent risk because users and operators may unknowingly send sensitive information to a third-party or separately persisted backend.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The workflow instructs the agent to copy full context and append final results into task cards, but it does not warn about the resulting storage of potentially sensitive user information. This is dangerous because it normalizes persistent transfer of detailed conversation data to an external system without minimization or disclosure.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The protocol explicitly instructs the agent to persist full user context and final results into task cards, which creates a natural-language data retention and leakage channel. In this skill context, the danger is heightened because task systems are persistent, shareable, and often accessed by multiple users or services, increasing exposure of sensitive content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The English workflow again tells the agent to store full context and final summaries in TaskBoard cards without disclosing the privacy implications. This creates a clear risk of retaining confidential prompts, internal reasoning summaries, or sensitive project details in an external persistence layer.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The English protocol duplicates the instruction to save full task context and outcomes to the board, reinforcing a persistent disclosure pattern rather than a one-off documentation lapse. Because this is a taskboard integration backed by an external MCP-connected system, sensitive user information may be retained, indexed, and exposed beyond the original chat session.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

A substantial portion of the README is presented only in Chinese, while no language-selection guidance or locale justification is given. This can violate language/locale policy when a skill effectively assumes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.