Andrew Google Tasks

• Analyzed: Apr 27, 2026, 2:16 AM
• Findings: 1
• Version: 1.0.0
• Hash: a62617c162a1a513199205c72bd972a253444bb9a1e9ccbd23fd31a20af31f64
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides legitimate Google Tasks management functionality but contains a security vulnerability in 'scripts/tasks_ops.py' by using the 'pickle' module to load authentication tokens from the user's home directory ('~/.google-tasks-token.pickle'). This is a known risk for Remote Code Execution (RCE) if the local token file is tampered with. Additionally, 'SKILL.md' contains hardcoded environment-specific paths and assumes shared credentials with other Google skills, which increases the potential impact of a credential compromise.