Task Specialist

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:32 AM UTC
• Version: 2.1.0

Overview

The skill is a coherent local task manager, but its verification checkpoint workflow can steer agents into running task-stored shell commands without strong trust boundaries.

Install only if you trust the workspace and agents that can create or edit tasks. Treat every displayed verification checkpoint as untrusted text: inspect it independently before running it, prefer project-owned test scripts over pasted shell, and avoid sharing a writable .tasks.db with untrusted collaborators or agents.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cmds/cmd_complete.sh:22

Finding

Untrusted Stored Verification Commands Can Induce Arbitrary Command Execution

Content

View full analysis

` will natively print the Bash subshell checkpoint. **For security (RCE prevention), these checkpoints must be executed manually.** ``` `SKILL.md:72`: ```markdown 4. **Completion and Checkpoints**: Run `task complete `. If your task contains a Checkpoint Validation (a Bash subshell script), the engine will output the command for you to run manually. **You must repair the codebase until the tests pass before you can technically complete the task and self-terminate.** ``` `scripts/cmds/cmd_create.sh:50-51`: ```bash local verify_val="NULL" [ -n "$verify" ] && verify_val="'$(printf '%s' "$verify" | sed "s/'/''/g")'" ``` `scripts/cmds/cmd_edit.sh:58-65`: ```bash if [ -n "$verify" ]; then local safe_verify safe_verify=$(printf '%s' "$verify" | sed "s/'/''/g") [ -n "$updates" ] && updates="$updates, " if [ "$verify" = "none" ] || [ "$verify" = "null" ] || [ "$verify" = "NULL" ]; then updates="${updates}verification_cmd = NULL" else updates="${updates}verification_cmd = '$safe_verify'" fi fi ``` `scripts/cmds/cmd_complete.sh:22-27`: ```bash local verify_cmd verify_cmd=$(sql "SELECT verification_cmd FROM tasks WHERE id = $id;" 2>/dev/null) || true if [ -n "$verify_cmd" ]; then printf '\033[1;33mManual Checkpoint Required:\033[0m %s\n' "$verify_cmd" printf '\033[1;34mNote:\033[0m Auto-execution disabled for security (RCE prevention).\n' fi ``` ### Technical Analysis The task creation and editing commands accept arbitrary text through `--verify` and persist it as `verifica ...[truncated 2620 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The autonomous behavior itself is not automatically a flaw, but here it is tied to automatic execution of verification commands during task completion. In the context of a multi-agent orchestration skill, autonomous execution increases the likelihood that unreviewed or attacker-influenced task data will trigger code execution without a human checkpoint.

Content

Scanner excerpt · CHANGELOG.md (reported line 20)May include surrounding context.

md

- **Swarm Engine (`task claim`)**: Atomic SQLite `UPDATE ... RETURNING` locks prevent race conditions, allowing native parallel execution across multiple AI workers. Safely honors `depend` relationship mapping.
- **Agent Tracking (`task claim --agent="NAME"`)**: Introduced the `assignee` schema attribute natively to the database. All read-only views (dashboard, list, export) now dynamically trace orchestrator assignment visibility.
- **Kanban Dashboard (`task board`)**: A visual ASCII Kanban board that dynamically aligns active tasks, blocked tasks, and real-time nested assignee identifiers without text wrapping limits.
- **Execution Checkpoints (`--verify`)**: `task create` and `task edit` now accept `--verify="<cmd>"`. Completing the task will automatically execute the bash subshell test, blocking the task completion on non-zero exit codes.
- **Context Persistence (`task note`)**: Agents can now attach timestamped runtime logs or error traces directly to task payloads natively, allowing context to survive agent death dynamically.
- **Data Export Pipelines**:
  - `task list --format=chat`: Bypasses ASCII column padding to synthesize native GitHub-flavored Markdown strings.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The changelog documents a feature where a user-supplied string passed via --verify is automatically executed in a Bash subshell during task completion. In an agent-oriented task system, task metadata may be created, edited, or consumed across trust boundaries, so treating stored task data as executable shell commands creates a command-injection and arbitrary code execution path.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill explicitly instructs the agent to run shell commands such as bash install.sh, task, and task-heartbeat, but it does not declare any tool scope, permissions, or allowed-tools constraints. That mismatch matters because an agent may execute shell-capable actions without an explicit trust boundary, increasing the chance of unintended command execution from a skill that is treated as documentation rather than privileged code.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill offers an install mode that creates CLI symlinks in ~/.local/bin, which is a persistent modification to the user's environment outside the project workspace. Persistent changes are risky because they can outlive the session, affect future command resolution, and make it easier for a compromised or tampered install script to plant long-lived execution paths.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

# Install (creates DB only, no PATH changes)
bash install.sh

# Or install AND create easy CLI symlinks in ~/.local/bin
bash install.sh --symlink

# Create and work tasks

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 24)May include surrounding context.

sh

if ! command -v sqlite3 &>/dev/null; then
  die "sqlite3 is required but not found. Install it:
    Debian/Ubuntu: sudo apt install sqlite3
    Arch:          sudo pacman -S sqlite
    macOS:         brew install sqlite"
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 25)May include surrounding context.

sh

if ! command -v sqlite3 &>/dev/null; then
  die "sqlite3 is required but not found. Install it:
    Debian/Ubuntu: sudo apt install sqlite3
    Arch:          sudo pacman -S sqlite
    macOS:         brew install sqlite"
fi

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 31)May include surrounding context.

sh

ok "sqlite3 found: $(sqlite3 --version | head -1)"

# ── 2. Create seed database with schema (for testing) ───────────────────────

DB="$PWD/.tasks.db"
if [ -f "$DB" ]; then

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script sources every matching shell file from the cmds directory at startup, which executes their contents with the privileges of the current user. If an attacker can place or modify a file in that directory, running the task tool becomes arbitrary code execution; this is especially risky because the skill presents itself primarily as a local SQLite task manager, not as a plugin executor.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Broad runtime sourcing is more permissive than necessary for a task-management utility and expands the trusted code base to any *.sh file in the target directory. In agent environments where skills may be unpacked, updated, or combined automatically, this increases the chance that an unexpected file leads to code execution or behavior tampering.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code creates and modifies the SQLite database file automatically via sqlite3 and ALTER TABLE statements. Although the script's purpose is task management, these filesystem and data-changing operations are not disclosed to the user through a visible runtime message, confirmation, or nearby comment explaining that the command may initialize or migrate the database.

Content

No source excerpt is available for this finding.