Security audit

C Task Cleanup

Security checks for vulnerabilities and agentic risk

Overview

This skill is a narrowly scoped task-cleanup script that deletes completed C-task entries and stores selected insights as documented, with some data-loss precautions users should understand.

Install only if you use the documented Chinese C-task workflow and are comfortable with automatic cleanup of the completed-task section. Keep backups or review the generated cleanup logs, especially before enabling any weekly cron schedule.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly describes clearing completed-task records and updating MEMORY.md, but it does not provide any visible warning, confirmation step, backup guidance, or scope limitation for these destructive file operations. This creates a real risk of unintended data loss or silent modification of user knowledge files, especially because the skill is framed as an automated weekly cleanup task.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The header describes the tool as only cleaning completed C-task records, but the implementation also extracts task content and writes selected items into a separate memory file. This undocumented secondary data flow can expose or persist user task content beyond its original location, especially if completed tasks contain sensitive notes, work items, or personal information.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The tool overwrites the task pool file in place and clears the completed-task section automatically, without confirmation, dry-run mode, or a backup/rollback mechanism. If parsing is wrong, paths are misconfigured, or the user did not expect deletion, this can cause irreversible loss of task history and integrity issues in personal workflow data.

Natural-Language Policy Violations

Low

Confidence: 87% confidence
Finding: The file description and all user-facing strings are written in Chinese, and the task file structure it expects is also locale-specific. There is no indication that the skill is intentionally limited to a Chinese-language environment or that users can opt into this locale.

Static analysis

No suspicious patterns detected.