Opentask Skill

ReviewAudited by ClawScan on May 10, 2026.

Overview

This is a coherent task-management skill, but it can let an OpenTask server and heartbeat checks steer agent work and mutate task state without clear approval or scope boundaries.

Install this only if you operate or fully trust the OPENTASK_HOST service. Do not add the HEARTBEAT auto-processing workflow unless you want queued OpenTask items to direct the agent’s work. Use scoped API keys, review queued tasks before execution, and avoid storing secrets or sensitive personal data in task parameters or logs.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI01: Agent Goal Hijack

What this means

A remote or shared task queue could become a source of instructions for the agent, potentially redirecting what the agent works on if the OpenTask server or task creators are not fully trusted.

Why it was flagged

This directs the agent, during heartbeat processing, to execute task logic obtained from the OpenTask queue. The artifacts do not specify how task creators, task content, or user approval are validated before execution.

Skill content

2. **有任务则执行**
   - 获取第一条任务 ID
   - 调用 `/api/tasks/{id}/start` 开始执行
   - 执行任务逻辑
   - 完成后调用 `/api/tasks/{id}/complete`

Recommendation

Only connect this skill to a trusted OpenTask server. Require review or approval before executing queued task content, and define allowed task types and trusted task creators.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The agent may mark tasks started, completed, failed, retried, or cancelled in OpenTask.

Why it was flagged

The skill documents multiple state-changing API operations. This is expected for a task-management client, but users should understand these calls mutate remote task state.

Skill content

PUT /api/tasks/{id}/start ... PUT /api/tasks/{id}/complete ... PUT /api/tasks/{id}/fail ... PUT /api/tasks/{id}/retry ... PUT /api/tasks/{id}/cancel

Recommendation

Use least-privilege API keys where possible and confirm that automated state changes are acceptable for your workflow.

Low

#ASI03: Identity and Privilege Abuse

What this means

Anyone or any agent with the API key may be able to perform OpenTask operations allowed by that key.

Why it was flagged

The skill requires a service API key for authenticated task operations. That credential is purpose-aligned but sensitive.

Skill content

`OPENTASK_API_KEY` | API 认证密钥（从服务端获取） ... **认证 Header** | `X-Bot-Key`

Recommendation

Store the API key securely, rotate it if exposed, and prefer keys scoped to the current bot/container rather than broad task-administration access.

Medium

#ASI07: Insecure Inter-Agent Communication

What this means

Task contents and parameters may be shared through the OpenTask service and acted on by different agents, which can expose sensitive task data or allow one actor to influence another agent.

Why it was flagged

The API is used to pass task parameters, steps, inputs, and outputs among multiple agent/container identities, but the artifacts do not describe origin checks, per-agent authorization, or data minimization.

Skill content

assigned_to 值 ... anna ... trump ... cc ... session_agent ... task_params 格式

JSON 字符串，灵活存储任务参数、步骤、输入输出

Recommendation

Treat OpenTask as a trusted coordination service only; avoid placing secrets in task_params, enforce per-agent authorization, and log/review who created each task.