Task System

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:07 PM UTC
• Version: 1.0.1

Overview

This is a local task-tracking skill, but its installer persistently changes shell startup files unsafely and its task ID handling can corrupt or alter the local task database.

Review before installing. The skill is not clearly malicious, but it should not be installed as-is unless you are comfortable with it modifying shell startup files and storing tasks locally. A safer version should escape installer paths, install the script from the correct scripts directory, avoid writing to ~/.bashrc by default, require explicit task IDs for mutations, and validate task IDs as integers before running SQLite updates.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/task-system.sh:13
• Finding: SQL Injection Through Unvalidated Task Identifiers<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/task-system.sh:13-21` - `scripts/heartbeat.sh:5-10` - `scripts/complete-task.sh:5-16` **Vulnerability Type**: SQL injection through direct interpolation of untrusted command-line input **Risk Level**: High ### Vulnerable Code `scripts/task-system.sh:13-21`: ```bash heartbeat|update) TASK_ID="${2:-1}" sqlite3 "$DB_PATH" "UPDATE tasks SET last_updated=CURRENT_TIMESTAMP WHERE id=$TASK_ID;" echo "Task #$TASK_ID heartbeat updated" ;; complete|done) TASK_ID="${2:-1}" NOTES="${3:-}" sqlite3 "$DB_PATH" "UPDATE tasks SET status='completed', completed_at=CURRENT_TIMESTAMP, last_updated=CURRENT_TIMESTAMP, notes='$(echo \"$NOTES\" | sed "s/'/''/g")' WHERE id=$TASK_ID;" ``` `scripts/heartbeat.sh:5-10`: ```bash DB_PATH="${HOME}/.openclaw/workspace/databases/tasks.db" TASK_ID="${1:-1}" [ -f "$DB_PATH" ] || exit 1 sqlite3 "$DB_PATH" "UPDATE tasks SET last_updated=CURRENT_TIMESTAMP WHERE id=$TASK_ID;" ``` `scripts/complete-task.sh:5-16`: ```bash DB_PATH="${HOME}/.openclaw/workspace/databases/tasks.db" TASK_ID="${1:-1}" NOTES="${2:-}" [ -f "$DB_PATH" ] || exit 1 sqlite3 "$DB_PATH" "UPDATE tasks SET status='completed', completed_at=CURRENT_TIMESTAMP, last_updated=CURRENT_TIMESTAMP, notes='$(echo "$NOTES" | sed "s/'/''/g")' WHERE id=$TASK_ID;" ``` ### Technical Analysis The scripts obtain `TASK_ID` directly from a command-line argument and interpolate it into SQL without verifying that it is an integer. Shell quoting does not prevent SQL injection because the untrusted value becomes part of the SQL statement passed to the SQLite command-line client. The SQLite client accepts multiple SQL statements in one input string. Consequently, a value containing a statement terminator can modify the intended query and append additional SQL. Escaping performed for `NOTES` does not protect `TASK_ID`. For example, a task ID conceptually shaped like the following changes the q ...[truncated 1275 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Strictly validate every task identifier before constructing a query: ```bash TASK_ID="${2:-}" if [[ ! "$TASK_ID" =~ ^[0-9]+$ ]]; then echo "Error: task ID must be a positive integer" >&2 exit 2 fi ``` 2. Apply equivalent validation in `task-system.sh`, `heartbeat.sh`, and `complete-task.sh`. 3. Do not silently default mutation operations to task ID `1`; require an explicit identifier to reduce accidental changes. 4. Prefer a SQLite API that supports bound parameters rather than constructing SQL with shell interpolation. 5. Check the SQLite process exit status and verify that exactly one expected row was affected before printing a success message. 6. Add regression tests using malformed values such as spaces, negative values, quotes, semicolons, SQL comments, and multiple statements. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: install.sh:7
• Finding: Persistent Shell Command Injection Through an Unsafe Installation Path<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:7-14` **Vulnerability Type**: Shell startup-file injection **Risk Level**: Medium ### Vulnerable Code ```bash # Add to PATH via bashrc.d (preferred) or .bashrc if [ -d "$HOME/.bashrc.d" ]; then echo "Adding task-system to PATH via ~/.bashrc.d" echo 'export PATH="'$SCRIPT_DIR':$PATH"' > "$HOME/.bashrc.d/task-system.sh" else echo "Adding task-system to PATH via ~/.bashrc" echo 'export PATH="'$SCRIPT_DIR':$PATH"' >> "$HOME/.bashrc" fi ``` ### Technical Analysis `SCRIPT_DIR` is derived from the location of `install.sh` and is inserted into text that will later be interpreted as shell code. The value is not serialized using shell-safe escaping. Although variable expansion during the `echo` command does not itself reinterpret metacharacters as shell syntax, those characters are written into `.bashrc` or `.bashrc.d/task-system.sh`. When a future shell sources that startup file, quotes, command separators, command substitutions, or newlines embedded in the installation path can become executable shell syntax. For example, an installation directory containing a double quote followed by a command separator can terminate the generated PATH string and append a command to the startup file. The generated configuration also points to the project root, while the executable is actually located under `scripts/`. The symlink later created from `$SCRIPT_DIR/task-system.sh` similarly targets a nonexistent path in the reviewed directory layout. This is primarily a correctness defect, but it also demonstrates that the installer is not safely or accurately constructing its installation paths. ### Attack Path 1. An attacker distributes or relocates the project under a directory name containing shell syntax, including a quote and command separator or an embedded newline. 2. A victim runs `install.sh` from that directory. 3. The installer embeds the crafted directory name into `.bashrc` or `.bashrc. ...[truncated 778 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Generate startup configuration using shell-safe serialization rather than direct interpolation: ```bash BIN_DIR="$SCRIPT_DIR/scripts" printf 'export PATH=%q:$PATH\n' "$BIN_DIR" > "$HOME/.bashrc.d/task-system.sh" ``` 2. If appending to `.bashrc`, use the same `%q` serialization and avoid duplicate entries. 3. Point PATH configuration and the symlink to the actual executable: ```bash ln -sf "$SCRIPT_DIR/scripts/task-system.sh" "$HOME/.local/bin/task-system" ``` 4. Validate that the resolved executable exists and is executable before changing user configuration. 5. Ask for explicit confirmation before modifying persistent shell startup files. 6. Prefer installing only the symlink under `~/.local/bin` when that directory is already on PATH, avoiding startup-file modification entirely. 7. Use `set -euo pipefail` and check every filesystem operation so the installer does not report success after a failed or incomplete installation. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The supplied code chunk is only an install script. It updates PATH by writing to ~/.bashrc.d or appending to ~/.bashrc and may create a symlink in ~/.local/bin. None of the declared core behaviors—task tracking, SQLite persistence, automatic creation, notifications, heartbeat monitoring, or stuck task recovery—are present in this code. Because the actual behavior is materially different from the declared purpose and performs shell-environment modification that is not described, this is a clear description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a broad, full-featured task management system with multiple capabilities: persistence, automatic creation, notifications, heartbeat monitoring, and stuck task recovery. The supplied code chunk implements only a narrow operation: marking an existing task as completed in a SQLite database and updating notes/timestamps. While this behavior is consistent with one small part of task management, it does not substantiate most of the declared capabilities. Therefore the description materially overstates what this code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The code does implement parts of the description: SQLite-backed task creation, heartbeat updates, completion, status listing, and detection of potentially stuck tasks. However, several declared capabilities are not present in the supplied code chunk. There is no notification mechanism, no automatic creation trigger or background automation, and no actual recovery of stuck tasks—only a query that lists overdue tasks. The implementation is therefore materially narrower than the declared purpose, making the description inaccurate.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

#!/bin/bash
# Task System Skill Installation Script
# Adds task-system.sh to PATH

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# Add to PATH via bashrc.d (preferred) or .bashrc
if [ -d "$HOME/.bashrc.d" ]; then
    echo "Adding task-system to PATH via ~/.bashrc.d"
    echo 'export PATH="'$SCRIPT_DIR':$PATH"' > "$HOME/.bashrc.d/task-system.sh"
else
    echo "Adding task-system to PATH via ~/.bashrc"
    echo 'export PATH="'$SCRIPT_DIR':$PATH"' >> "$HOME/.bashrc"
fi

# Also create symlink in ~/.local/bin if exists
if [ -d "$HOME/.local/bin" ]; then
    ln -sf "$SCRIPT_DIR/task-system.sh" "$HOME/.local/bin/task-system"
    echo "Created symlink: ~/.local/bin/task-system"
fi

echo "✓ task-system installed!"
echo "  Usage: task-system.sh create 'Your task'"
echo "  Or:    task-system status"
echo ""
echo "Restart your terminal or run: source ~/.bashrc"

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The description 'Use for all task management needs' is overly broad and can cause this skill to be invoked in contexts beyond its intended scope. In an agent ecosystem, overly broad routing language can trigger unnecessary execution of install/setup logic or task-manipulation commands, increasing the chance of unintended side effects or misuse.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo 'export PATH="'$SCRIPT_DIR':$PATH"' >> "$HOME/.bashrc"
fi

# Also create symlink in ~/.local/bin if exists
if [ -d "$HOME/.local/bin" ]; then
    ln -sf "$SCRIPT_DIR/task-system.sh" "$HOME/.local/bin/task-system"
    echo "Created symlink: ~/.local/bin/task-system"

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This script performs a persistent database update that changes task status and notes, but it provides no confirmation prompt or advance user-facing warning before making the change. The only visible message appears after the update, so users are not informed before the irreversible state change occurs.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: This code creates a database under the user's home directory and inserts the provided request text into it, which is a persistent file write affecting user data. Although there are comments describing usage, there is no explicit user-facing disclosure in the script output about creating or modifying local storage.

Static analysis

No suspicious patterns detected.