Security audit

Kinema's Task Management (daily report, active push, traceback)

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed personal task tracker that stores task files locally and can optionally schedule task reports, with no artifact evidence of deception or unrelated data access.

Install only if you want an agent-managed markdown task tracker. Before enabling scheduled reports, confirm the channel and recipient carefully, remember reports may include task titles and status details, and remove or disable the cron jobs if you no longer want automatic pushes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The onboarding directs the agent to extract untrusted session metadata and configure recurring outbound notifications to external chat destinations via cron. That expands the skill from local markdown task management into persistent message delivery, creating a channel for unintended data disclosure, misdelivery, or abuse if metadata is wrong, spoofed, stale, or not explicitly user-approved. In this skill context, the behavior is more dangerous because scheduled reports may include task contents and continue sending automatically after setup.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The document correctly warns that `--to` must use the conversation `chat_id`, but later labels it as a target user ID, creating ambiguity around the destination identifier. This can cause operators or agents to send scheduled reports to the wrong recipient or channel, resulting in accidental disclosure of task data; the skill context increases risk because cron jobs persist and repeatedly push content once misconfigured.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The invocation examples include very broad, natural phrases such as '看看任务列表' and '任务报告', which can overlap with ordinary conversation and cause the skill to trigger unintentionally. In a task-management skill that persists and updates files, accidental activation can lead to unintended task creation, modification, or archival without clear user intent.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger conditions are broad enough to activate on ordinary conversation containing generic words like 'task' or on scheduled heartbeats, which can cause unintended file reads or modifications in the user's workspace. In this skill, unintended invocation is more concerning because the agent is instructed to scan active/archived task files and may update or archive records, creating integrity and privacy risks even without overtly malicious intent.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.