Security audit

Vikunja Tasks

Security checks for vulnerabilities and agentic risk

Overview

This Vikunja task skill mostly matches its purpose, but its helper script has unsafe input handling that can run crafted local code and may expose the API token if configured with HTTP.

Review this skill before installing. Use it only with a trusted Vikunja URL over HTTPS, a least-privilege API token, and clear user confirmation before write actions. The script should be fixed to URL-encode arguments safely, reject non-HTTPS remote URLs, and make the timezone configurable before routine use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/vikunja.sh:90
Finding: Arbitrary Local Command Execution Through Python Source Injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/vikunja.sh:20
Finding: Bearer Token Can Be Transmitted Over Plaintext HTTP
Content: View full analysis
&2 exit 1 fi API="${VIKUNJA_URL}/api/v1" AUTH="Authorization: Bearer ${VIKUNJA_TOKEN}" # --- Helpers --- api_get() { curl -s -H "$AUTH" "${API}/$1" } api_put() { curl -s -X PUT -H "$AUTH" -H "Content-Type: application/json" "${API}/$1" -d "$2" } ``` The same authentication-header behavior is used by the subsequent `api_post` and `api_delete` helper functions. ### Technical Analysis The script accepts `VIKUNJA_URL` without validating its URL scheme and unconditionally places `VIKUNJA_TOKEN` in an HTTP `Authorization` header. Although `SKILL.md` shows an HTTPS example, HTTPS is not enforced by the implementation. If the configured URL begins with `http://`, the bearer token, request bodies, and returned task data are transmitted without transport encryption. Bearer tokens grant access based solely on possession, so interception may allow an attacker to impersonate the Skill for as long as the token remains valid. This issue is configuration-dependent: exploitation requires a plaintext HTTP endpoint and an attacker with visibility into, or control over, the relevant network path. ### Attack Path 1. `VIKUNJA_URL` is accidentally or maliciously configured with an `http://` URL. 2. A Skill command invokes one of the API helper functions. 3. `curl` sends the `Authorization: Bearer ...` header and application data over plaintext HTTP. 4. A network-positioned attacker captures or alters the traffic. 5. The attacker extracts the bearer token. 6. The attacker submits independent API requests to the Vikunja server using the stolen token. ### Impact Assessment An attacker who intercepts the token can perform any opera ...[truncated 547 chars]
Remediation: View remediation
&2 exit 1 ;; esac ``` Additional hardening should include: 1. Prefer rejecting all HTTP URLs, including loopback addresses, in production deployments. 2. Document HTTPS as mandatory rather than merely showing it in an example. 3. Use a least-privilege Vikunja token with only the API permissions required by this Skill. 4. Rotate the token immediately if it may previously have been used over plaintext HTTP. 5. Improve request failure handling with options such as: ```bash curl --fail --show-error --silent ``` 6. Preserve curl's default TLS certificate verification and do not introduce `--insecure`. 7. Where private certificate authorities are used, configure the trusted CA explicitly instead of disabling verification. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill invokes shell commands and makes network-backed API calls to a self-hosted Vikunja instance, but it declares no explicit tool scope or permissions boundary. That increases the chance the agent can use broader shell/network capabilities than intended, making unintended external access or command execution harder to constrain and audit.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description is broad enough to match many ordinary productivity requests, which can cause the skill to activate when the user did not specifically intend to interact with their Vikunja instance. In this skill's context, overbroad activation is more dangerous because the skill supports persistent task and project modifications against a live self-hosted service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation presents create/complete/project-creation commands as routine actions without clearly warning that they will modify persistent data on the user's Vikunja instance. This can lead to accidental writes or state changes, especially if an agent follows the examples automatically in response to ambiguous user requests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill hard-codes America/Denver for due-date handling and cron scheduling without offering a user-configurable timezone. In a task-management context, this can cause reminders, overdue calculations, and notifications to occur at the wrong times, potentially leading to missed deadlines or misleading automation behavior.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/vikunja.sh (reported line 33)May include surrounding context.
sh
# --- Helpers --- api_get() { curl -s -H "$AUTH" "${API}/$1" } api_put() {

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The task-listing request forces filter_timezone=America/Denver, which imposes a specific locale setting on all users. This can violate language/locale policy expectations because the script does not offer a user choice or explain why this region-specific timezone is required.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Both the overdue and due commands use filter_timezone=America/Denver, again enforcing a region-specific locale assumption in user-visible task filtering behavior. The script provides no opt-in, override, or explanation for this fixed timezone choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.