Queue Task

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:15 PM UTC
• Version: 0.1.0

Overview

This skill is a legitimate queue helper, but its task slug can escape the intended task folder and create or modify files elsewhere writable by the agent.

Review this before installing if the skill may be used with slugs from users, issue trackers, automation, or other untrusted inputs. Only use simple slugs made from letters, numbers, underscores, or hyphens, and prefer fixing the helper to reject absolute paths, path separators, dot components, and any resolved path outside the configured task root.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/queue_task.py:44

Finding

Unsanitized Task Slug Allows Path Traversal and Arbitrary Filesystem Modification

Content

View full analysis

Vulnerability Details

File Location: scripts/queue_task.py, lines 44-47; filesystem write sinks at lines 76-104 and 148-149
Vulnerability Type: Path traversal / arbitrary directory targeting
Risk Level: High

Vulnerable Code

python

def resolve_dir(cfg: Dict[str, str], slug: str) -> pathlib.Path:
    ws = pathlib.Path(cfg['WORKSPACE_DIR']).expanduser().resolve()
    tasks_dir = cfg.get('TASKS_DIR', 'tasks')
    return ws / tasks_dir / slug

The returned path is subsequently used for filesystem creation and modification:

python

def ensure_files(base: pathlib.Path, slug: str, with_task_docs: bool = False) -> Dict[str, pathlib.Path]:
    base.mkdir(parents=True, exist_ok=True)
    if with_task_docs:
        ensure_task_docs_if_missing(base, slug)
    p = {
        'queue': base / 'queue.jsonl',
        'progress': base / 'progress.json',
        'done': base / 'done.jsonl',
        'failed': base / 'failed.jsonl',
        'lock': base / 'lock.json',
    }
    for k in ('queue', 'done', 'failed'):
        if not p[k].exists():
            p[k].write_text('', encoding='utf-8')
    if not p['progress'].exists():
        write_json(p['progress'], {
            'task': slug,
            'status': 'init',
            'updatedAt': now_iso(),
            'cursor': None,
            'counts': {'processed': 0, 'done': 0, 'failed': 0, 'skipped': 0},
            'blocking_reason': None,
            'layout': 'task-folder' if (base / 'TASK.md').exists() else 'standalone',
        })
    if not p['lock'].exists():
        p['lock'].write_text('', encoding='utf-8')
    return p

The stale-lock command can also truncate a targeted lock.json:

python

except Exception:
    lock.write_text('', encoding='utf-8')
    print('cleared_unparsable_lock')

Technical Analysis

The positional slug argument is controlled by the command-line caller an ...[truncated 3168 chars]

Remediation

View remediation

Remediation Suggestions

Treat the slug as an identifier rather than a path:

1. Reject empty values, absolute paths, path separators, . components, and .. components.

2. Apply a restrictive allowlist, such as letters, digits, underscores, and hyphens:

   python

   import re
   
   SLUG_PATTERN = re.compile(r'^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$')
   
   def validate_slug(slug: str) -> str:
       if not SLUG_PATTERN.fullmatch(slug):
           raise ValueError('Invalid task slug')
       return slug
   

3. Resolve the complete candidate path and verify that it remains beneath the resolved task root:

   python

   def resolve_dir(cfg: Dict[str, str], slug: str) -> pathlib.Path:
       slug = validate_slug(slug)
       workspace = pathlib.Path(cfg['WORKSPACE_DIR']).expanduser().resolve()
       task_root = (workspace / cfg.get('TASKS_DIR', 'tasks')).resolve()
       candidate = (task_root / slug).resolve()
   
       if not candidate.is_relative_to(task_root):
           raise ValueError('Task directory escapes the configured task root')
       return candidate
   

4. Validate TASKS_DIR as well, particularly if configuration files may be modified by less-trusted users. Resolve the intended task root before performing containment checks.

5. Refuse to follow symbolic links in task directories or state files where feasible. Use secure file-opening primitives and verify file type and ownership before truncating lock.json.

6. Do not clear an unparsable lock automatically. Report the error and require an explicit, separately authorized force option.

7. Add tests covering absolute slugs, ../ traversal, nested separators, symbolic links, malformed locks, and paths exactly outside the configured task root.

8. Run the skill under a least-privileged account with filesystem access limited to the configured task root as defense in depth.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill describes operations that read and write task state files but does not declare any explicit tool scope such as permissions or allowed-tools. That omission can cause an agent runtime to grant broader filesystem access than intended or leave reviewers unable to verify that file access is constrained to the task folder, increasing the risk of unauthorized reads or writes if the skill is invoked with unexpected inputs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.