ClawHub
Back to skill

Security audit

Proactive Tasks

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed local task manager, but it needs review because it enables recurring autonomous work and writes shared workspace state without tight consent or scoping controls.

Install only if you intentionally want a persistent autonomous task manager. Before enabling heartbeat or cron, restrict it to named approved projects, require human approval for external or irreversible actions, avoid putting secrets or sensitive business details in task notes, and periodically review or clear SESSION-STATE.md and memory files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs the agent to read and write multiple workspace files (`SESSION-STATE.md`, `working-buffer.md`, `memory/WAL-*.log`, `data/tasks.json`) and run a task manager CLI, but it does not declare corresponding permissions. This creates a capability/permission mismatch that can lead to unnoticed persistence, file modification, and broader-than-expected workspace access by agents or operators who rely on declared permissions for trust and review.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The script is explicitly configured to write to files outside its own task data directory, including workspace-level memory and SESSION-STATE files. In an agent skill, this broadens the blast radius of a task-management action into shared state that may influence other components, leak task content, or overwrite unrelated agent context.

Description-Behavior Mismatch

Low
Confidence
88% confidence
Finding
The health-check routine does more than inspect integrity: it automatically rewrites task fields and timestamps when it detects anomalies. Silent mutation during a diagnostic operation can destroy evidence of prior state, cause unintended workflow changes, and make the command unsafe to run in automation where read-only behavior is expected.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The progress-marking logic sets tasks with progress >= 100 to in_progress instead of completed, contradicting the system's own completion semantics. This can be exploited to keep tasks appearing active despite full completion, leading autonomous agents to rework finished items, make incorrect planning decisions, or corrupt workflow state over time.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README explicitly instructs agents to run task-management commands on every heartbeat and then autonomously work on returned tasks, which normalizes unattended state-changing behavior. Even though the modification target appears limited to local task data (for example tasks.json), the absence of warnings, scope limits, or approval boundaries can cause unintended file changes, noisy automation, and drift from user intent when an agent follows these instructions blindly.

Vague Triggers

Medium
Confidence
79% confidence
Finding
The activation description is broad enough that the skill could be invoked for many ordinary planning or project-related conversations, causing autonomous task tracking and persistence to begin without clear user consent. In context, this is more dangerous because the skill is designed to operate proactively and maintain long-lived state, so accidental invocation can lead to unexpected file writes, reminders, or autonomous actions.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The instruction 'When your human mentions a goal or project' is ambiguous and encourages the agent to convert casual discussion into tracked goals automatically. Because this skill persists state and later acts on it during heartbeats, a loose trigger can capture speculative or sensitive user plans and turn them into ongoing autonomous workflows without confirmation.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The code persists auto-fixes immediately when any issues are found, without an explicit warning or confirmation to the user. In a self-healing agent context, this is risky because routine inspection can unexpectedly alter durable state, making debugging harder and allowing silent state drift across autonomous runs.

Session Persistence

Medium
Category
Rogue Agent
Content
**Quick setup:** See [HEARTBEAT-CONFIG.md](HEARTBEAT-CONFIG.md) for complete setup instructions and patterns.

**TL;DR:**
1. Create a cron job that sends you a heartbeat message every 30 minutes
2. Add proactive-tasks checks to your `HEARTBEAT.md`
3. You'll automatically check for tasks and work on them without waiting for prompts
Confidence
95% confidence
Finding
Create a cron job that

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.