Todo Management 1.1.2

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:30 AM UTC
• Version: 1.0.0

Overview

This is a local todo-list skill whose behavior matches its stated purpose, with only low-risk documentation and dependency hygiene notes.

Install only if you are comfortable with a local todo.db being created or changed in each workspace. Use --delete-entries carefully because it deletes todo records in that group, and consider removing the unused npm package files before publishing or installing through Node tooling.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: package.json:2
• Finding: Unnecessary Third-Party Dependency Expands the Supply-Chain Attack Surface## Vulnerability Details **File Location**: `package.json:2-4` **Vulnerability Type**: Unnecessary third-party dependency **Risk Level**: Low ### Vulnerable Code ```json "dependencies": { "package-lock.json": "^1.0.0" } ``` The dependency is resolved in `package-lock.json:10-14`: ```json "node_modules/package-lock.json": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/package-lock.json/-/package-lock.json-1.0.0.tgz", "integrity": "sha512-+yEXtNdlCs5N0Zy/9uvkifgf/RqnGu0WqP4j9Wu1Us4YReFe1YNBh2Krmf8B1xGxjpYnta63K55QP8bkafnOzA==" } ``` The same dependency is also declared in `pnpm-lock.yaml:8-18`: ```yaml dependencies: package-lock.json: specifier: ^1.0.0 version: 1.0.0 packages: package-lock.json@1.0.0: resolution: {integrity: sha512-+yEXtNdlCs5N0Zy/9uvkifgf/RqnGu0WqP4j9Wu1Us4YReFe1YNBh2Krmf8B1xGxjpYnta63K55QP8bkafnOzA==} snapshots: package-lock.json@1.0.0: {} ``` ### Technical Analysis The project implementation consists of a Bash script backed by SQLite and does not invoke Node.js or import the `package-lock.json` package. The dependency therefore provides no functionality required by the declared todo-management behavior. Although the reviewed lockfiles resolve version `1.0.0` from the official npm registry and pin it with an integrity hash, retaining an unrelated dependency unnecessarily introduces third-party package content into installations. This enlarges the supply-chain attack surface and creates exposure to future package compromise, unsafe version updates, registry-account takeover, or unexpected package lifecycle behavior. The reviewed evidence does not establish that the currently pinned package is malicious. The issue is the unjustified external dependency and resulting avoidable supply-chain risk. ### Attack Path 1. A user or automated build process runs `npm install` or `pnpm install`. 2. The package manager reads the dependency declaration and lockfile. 3. It downloads and installs the unrel ...[truncated 1066 chars]
• Remediation: ## Remediation Suggestions 1. Remove the unused dependency from `package.json`: ```json { "dependencies": {} } ``` 2. Because the project has no demonstrated Node.js runtime requirement, preferably remove `package.json`, `package-lock.json`, and `pnpm-lock.yaml` entirely. 3. If package metadata must remain, regenerate both lockfiles after removing the dependency and verify that they contain no package entries. 4. Add automated dependency review to reject dependencies that are not referenced by the implementation. 5. In CI environments, use locked, reproducible installations and disable package lifecycle scripts where they are unnecessary, such as with `npm ci --ignore-scripts`.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The markdown shows a `group remove ... --delete-entries` command, which can permanently delete todo entries, but the surrounding documentation does not explicitly warn that this is destructive or irreversible. Under the markdown-file criteria for missing user warnings, destructive operations affecting user data should be clearly disclosed.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

{
	"dependencies": {
		"package-lock.json": "^1.0.0"
	}
}

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Static analysis

No suspicious patterns detected.