agent-task-manager

• Outcome: Review
• Latest audit: May 28, 2026 · 8:15 AM UTC
• Version: 1.0.2

Overview

This skill has a coherent workflow-management purpose, but it should be reviewed before install because it sends workflow content to SkillBoss and includes an unsafe shell cooldown wrapper.

Install only if you trust SkillBoss with task descriptions, prompts, recipients, and notification content. Avoid using cooldown.sh with any dynamic or untrusted command text unless it is patched to avoid eval, review notification recipients before use, and keep the SkillBoss API key protected and rotated as appropriate.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The parser forwards arbitrary user requests to a third-party API for interpretation, which can disclose sensitive user content and expands the skill's effective capabilities beyond local parsing. Because the skill context provides no clear consent, data-classification boundary, or necessity justification, this is an unjustified external-processing path that can leak proprietary or personal data.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The description is broad enough to attract invocation for generic multi-agent orchestration, sequential workflows, and time-bound actions rather than a narrowly scoped capability. Overly broad matching increases the chance the skill is selected in contexts where users and operators do not expect its external API calls, persistent state handling, or notification behavior, which can lead to unintended data exposure or action execution.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill advertises AI inference and notification delivery through an external service but does not warn that workflow data may be transmitted off-platform. In a task-management/orchestration context, inputs can contain sensitive operational details, so omission of a disclosure materially increases privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The example workflow includes email/SMS alert delivery without warning users that the skill can initiate outbound communications. In practice, this can surprise users, leak sensitive results to third parties, or trigger unwanted contact if recipients and content are not explicitly approved.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The API integration section describes a bearer-token authenticated external endpoint without any guidance on credential protection, safe secret handling, or the implications of sending task content to a third-party service. In an orchestration skill that may process varied and sensitive workflows, this omission makes accidental secret exposure and unauthorized external sharing more likely.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script builds a command from positional arguments and executes it with eval, which causes the shell to re-parse the string and enables command injection if any part of COMMAND is influenced by untrusted input. In an agent/automation context this is more dangerous because task names and wrapped commands may be dynamically assembled, turning a generic wrapper into an arbitrary code execution primitive.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: User/task content in the request body is transmitted to a third-party API without any evident disclosure, minimization, or trust boundary controls. In this skill, parsed task fields such as token identifiers, recipients, channels, and messages may leave the local environment, which increases privacy and data-handling risk if sensitive content is included.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Unknown user requests are transmitted to an external service without any explicit disclosure at the call site that their text leaves the local environment. If users include secrets, internal project details, or personal data in natural-language requests, that information is exposed to the external provider and its retention policies.

External Transmission

Medium

• Category: Data Exfiltration

Content

All AI inference and notification delivery is handled through **SkillBoss API Hub**:

- **Endpoint:** `https://api.skillboss.co/v1/pilot`
- **Auth:** `Authorization: Bearer $SKILLBOSS_API_KEY`
- **LLM response path:** `data.result.choices[0].message.content`

• Confidence: 90% confidence
• Finding: The skill explicitly transmits AI inference and notification data to an external endpoint. External transmission is contextually expected for this skill, but it still constitutes a real security and privacy risk because task contents, prompts, and notification payloads may leave the local trust boundary and be processed by a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

def _pilot(body: dict) -> dict:
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,

• Confidence: 82% confidence
• Finding: The code sends workflow data to an external service endpoint, creating an off-box data egress path. In context this is intentional functionality, but it is still security-relevant because untrusted or sensitive task content may be disclosed to a third party and because the service can influence downstream behavior.

External Transmission

Medium

• Category: Data Exfiltration

Content

def _pilot(body: dict) -> dict:
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,

• Confidence: 84% confidence
• Finding: This code performs an outbound network call to a third-party endpoint, carrying both authenticated context and user-derived content. External transmission is not automatically malicious, but in this skill it increases risk because the parser may handle arbitrary natural-language input that can contain sensitive information.

Static analysis

No suspicious patterns detected.