Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Taasky negotiation helper that uses a remote MCP service and stored room tokens, with meaningful but purpose-aligned delegation to the agent.
Install this only if you want an agent to negotiate through Taasky, store room tokens for later access, and make proposals or counters within limits you provide. Give clear boundaries, deadlines, and non-negotiables, and review confirmation cards carefully before approving any final agreement.
The skill description is very broad and explicitly targets common user intents like scheduling, booking, shift swaps, and price negotiation. That increases the chance of over-invocation on ordinary requests and can route users into an external negotiation workflow that stores room tokens and may trigger autonomous actions before the user clearly intended to use Taasky.
The skill is designed to let the agent counter and move negotiations forward 'without asking every round,' which delegates meaningful negotiation decisions to the agent within pre-set limits. Even with human confirmation on accept/reject/withdraw, the agent can still make consequential offers, counters, and deadline changes that may misrepresent the user's intent or create pressure and commitment in external negotiations.
1. **What** is being settled, and **with whom**.
2. **Their limits**: the most they will pay, the least they will take, the
earliest and latest they can meet, what is non-negotiable. You need these
to counter without asking every round.
3. **By when.** It becomes the deadline.
4. **Their time zone**, if you don't know it. You will need it for every time
you write and every time you read back.
The instruction to write labels 'in your human's language' can cause the skill to infer or enforce a language choice without an explicit user preference. While not directly a code-execution risk, it can lead to confusing or incorrect user-facing terms in confirmations, which is risky in a negotiation flow where humans must approve exact terms.
No suspicious patterns detected.