Todo Management 1.1.2

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:30 AM UTC
• Version: 1.0.0

Overview

This is a local todo-list skill whose behavior matches its stated purpose, with only low-risk documentation and dependency hygiene notes.

Install only if you are comfortable with a local todo.db being created or changed in each workspace. Use --delete-entries carefully because it deletes todo records in that group, and consider removing the unused npm package files before publishing or installing through Node tooling.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: package.json:2

Finding

Unnecessary Third-Party Dependency Expands the Supply-Chain Attack Surface

Content

View full analysis

Vulnerability Details

File Location: package.json:2-4
Vulnerability Type: Unnecessary third-party dependency
Risk Level: Low

Vulnerable Code

json

"dependencies": {
  "package-lock.json": "^1.0.0"
}

The dependency is resolved in package-lock.json:10-14:

json

"node_modules/package-lock.json": {
  "version": "1.0.0",
  "resolved": "https://registry.npmjs.org/package-lock.json/-/package-lock.json-1.0.0.tgz",
  "integrity": "sha512-+yEXtNdlCs5N0Zy/9uvkifgf/RqnGu0WqP4j9Wu1Us4YReFe1YNBh2Krmf8B1xGxjpYnta63K55QP8bkafnOzA=="
}

The same dependency is also declared in pnpm-lock.yaml:8-18:

yaml

dependencies:
  package-lock.json:
    specifier: ^1.0.0
    version: 1.0.0

packages:

  package-lock.json@1.0.0:
    resolution: {integrity: sha512-+yEXtNdlCs5N0Zy/9uvkifgf/RqnGu0WqP4j9Wu1Us4YReFe1YNBh2Krmf8B1xGxjpYnta63K55QP8bkafnOzA==}

snapshots:

  package-lock.json@1.0.0: {}

Technical Analysis

The project implementation consists of a Bash script backed by SQLite and does not invoke Node.js or import the package-lock.json package. The dependency therefore provides no functionality required by the declared todo-management behavior.

Although the reviewed lockfiles resolve version 1.0.0 from the official npm registry and pin it with an integrity hash, retaining an unrelated dependency unnecessarily introduces third-party package content into installations. This enlarges the supply-chain attack surface and creates exposure to future package compromise, unsafe version updates, registry-account takeover, or unexpected package lifecycle behavior.

The reviewed evidence does not establish that the currently pinned package is malicious. The issue is the unjustified external dependency and resulting avoidable supply-chain risk.

Attack Path

1. A user or automated build process runs npm install or pnpm install.
2. The package manager reads the dependency declaration and lockfile.
3. It downloads and installs the unrel ...[truncated 1066 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unused dependency from package.json:

json

{
  "dependencies": {}
}

2. Because the project has no demonstrated Node.js runtime requirement, preferably remove package.json, package-lock.json, and pnpm-lock.yaml entirely.
3. If package metadata must remain, regenerate both lockfiles after removing the dependency and verify that they contain no package entries.
4. Add automated dependency review to reject dependencies that are not referenced by the implementation.
5. In CI environments, use locked, reproducible installations and disable package lifecycle scripts where they are unnecessary, such as with npm ci --ignore-scripts.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown shows a group remove ... --delete-entries command, which can permanently delete todo entries, but the surrounding documentation does not explicitly warn that this is destructive or irreversible. Under the markdown-file criteria for missing user warnings, destructive operations affecting user data should be clearly disclosed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 3)May include surrounding context.

json

{
	"dependencies": {
		"package-lock.json": "^1.0.0"
	}
}

Static analysis

No suspicious patterns detected.