Task System

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:07 PM UTC
• Version: 1.0.1

Overview

This is a local task-tracking skill, but its installer persistently changes shell startup files unsafely and its task ID handling can corrupt or alter the local task database.

Review before installing. The skill is not clearly malicious, but it should not be installed as-is unless you are comfortable with it modifying shell startup files and storing tasks locally. A safer version should escape installer paths, install the script from the correct scripts directory, avoid writing to ~/.bashrc by default, require explicit task IDs for mutations, and validate task IDs as integers before running SQLite updates.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/task-system.sh:13

Finding

SQL Injection Through Unvalidated Task Identifiers

Content

View full analysis

Remediation

View remediation

&2 exit 2 fi ``` 2. Apply equivalent validation in `task-system.sh`, `heartbeat.sh`, and `complete-task.sh`. 3. Do not silently default mutation operations to task ID `1`; require an explicit identifier to reduce accidental changes. 4. Prefer a SQLite API that supports bound parameters rather than constructing SQL with shell interpolation. 5. Check the SQLite process exit status and verify that exactly one expected row was affected before printing a success message. 6. Add regression tests using malformed values such as spaces, negative values, quotes, semicolons, SQL comments, and multiple statements. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: install.sh:7

Finding

Persistent Shell Command Injection Through an Unsafe Installation Path

Content

View full analysis

"$HOME/.bashrc.d/task-system.sh" else echo "Adding task-system to PATH via ~/.bashrc" echo 'export PATH="'$SCRIPT_DIR':$PATH"' >> "$HOME/.bashrc" fi ``` ### Technical Analysis `SCRIPT_DIR` is derived from the location of `install.sh` and is inserted into text that will later be interpreted as shell code. The value is not serialized using shell-safe escaping. Although variable expansion during the `echo` command does not itself reinterpret metacharacters as shell syntax, those characters are written into `.bashrc` or `.bashrc.d/task-system.sh`. When a future shell sources that startup file, quotes, command separators, command substitutions, or newlines embedded in the installation path can become executable shell syntax. For example, an installation directory containing a double quote followed by a command separator can terminate the generated PATH string and append a command to the startup file. The generated configuration also points to the project root, while the executable is actually located under `scripts/`. The symlink later created from `$SCRIPT_DIR/task-system.sh` similarly targets a nonexistent path in the reviewed directory layout. This is primarily a correctness defect, but it also demonstrates that the installer is not safely or accurately constructing its installation paths. ### Attack Path 1. An attacker distributes or relocates the project under a directory name containing shell syntax, including a quote and command separator or an embedded newline. 2. A victim runs `install.sh` from that directory. 3. The installer embeds the crafted directory name into `.bashrc` or `.bashrc. ...[truncated 778 chars]

Remediation

View remediation

"$HOME/.bashrc.d/task-system.sh" ``` 2. If appending to `.bashrc`, use the same `%q` serialization and avoid duplicate entries. 3. Point PATH configuration and the symlink to the actual executable: ```bash ln -sf "$SCRIPT_DIR/scripts/task-system.sh" "$HOME/.local/bin/task-system" ``` 4. Validate that the resolved executable exists and is executable before changing user configuration. 5. Ask for explicit confirmation before modifying persistent shell startup files. 6. Prefer installing only the symlink under `~/.local/bin` when that directory is already on PATH, avoiding startup-file modification entirely. 7. Use `set -euo pipefail` and check every filesystem operation so the installer does not report success after a failed or incomplete installation. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code chunk is only an install script. It updates PATH by writing to ~/.bashrc.d or appending to ~/.bashrc and may create a symlink in ~/.local/bin. None of the declared core behaviors—task tracking, SQLite persistence, automatic creation, notifications, heartbeat monitoring, or stuck task recovery—are present in this code. Because the actual behavior is materially different from the declared purpose and performs shell-environment modification that is not described, this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad, full-featured task management system with multiple capabilities: persistence, automatic creation, notifications, heartbeat monitoring, and stuck task recovery. The supplied code chunk implements only a narrow operation: marking an existing task as completed in a SQLite database and updating notes/timestamps. While this behavior is consistent with one small part of task management, it does not substantiate most of the declared capabilities. Therefore the description materially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code does implement parts of the description: SQLite-backed task creation, heartbeat updates, completion, status listing, and detection of potentially stuck tasks. However, several declared capabilities are not present in the supplied code chunk. There is no notification mechanism, no automatic creation trigger or background automation, and no actual recovery of stuck tasks—only a query that lists overdue tasks. The implementation is therefore materially narrower than the declared purpose, making the description inaccurate.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · install.sh (reported line 10)May include surrounding context.

sh

#!/bin/bash
# Task System Skill Installation Script
# Adds task-system.sh to PATH

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# Add to PATH via bashrc.d (preferred) or .bashrc
if [ -d "$HOME/.bashrc.d" ]; then
    echo "Adding task-system to PATH via ~/.bashrc.d"
    echo 'export PATH="'$SCRIPT_DIR':$PATH"' > "$HOME/.bashrc.d/task-system.sh"
else
    echo "Adding task-system to PATH via ~/.bashrc"
    echo 'export PATH="'$SCRIPT_DIR':$PATH"' >> "$HOME/.bashrc"
fi

# Also create symlink in ~/.local/bin if exists
if [ -d "$HOME/.local/bin" ]; then
    ln -sf "$SCRIPT_DIR/task-system.sh" "$HOME/.local/bin/task-system"
    echo "Created symlink: ~/.local/bin/task-system"
fi

echo "✓ task-system installed!"
echo "  Usage: task-system.sh create 'Your task'"
echo "  Or:    task-system status"
echo ""
echo "Restart your terminal or run: source ~/.bashrc"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description 'Use for all task management needs' is overly broad and can cause this skill to be invoked in contexts beyond its intended scope. In an agent ecosystem, overly broad routing language can trigger unnecessary execution of install/setup logic or task-manipulation commands, increasing the chance of unintended side effects or misuse.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 16)May include surrounding context.

sh

echo 'export PATH="'$SCRIPT_DIR':$PATH"' >> "$HOME/.bashrc"
fi

# Also create symlink in ~/.local/bin if exists
if [ -d "$HOME/.local/bin" ]; then
    ln -sf "$SCRIPT_DIR/task-system.sh" "$HOME/.local/bin/task-system"
    echo "Created symlink: ~/.local/bin/task-system"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This script performs a persistent database update that changes task status and notes, but it provides no confirmation prompt or advance user-facing warning before making the change. The only visible message appears after the update, so users are not informed before the irreversible state change occurs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code creates a database under the user's home directory and inserts the provided request text into it, which is a persistent file write affecting user data. Although there are comments describing usage, there is no explicit user-facing disclosure in the script output about creating or modifying local storage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.