ClawHub
Back to skill

Security audit

Task Orchestrator

Security checks for vulnerabilities and agentic risk

Overview

This task orchestration skill is a local planning helper that writes or updates task JSON files and may suggest other agents, with no evidence of hidden network access, credential handling, or persistence.

Install only if you want a planning/orchestration helper that can create and update local task JSON files. Treat any suggested agent execution, web search, publishing, sending, deployment, or retry as requiring your explicit approval before it happens.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The code only covers a narrow subset of the declared description: it makes priority decisions and suggests an execution order based on dependencies. It does not implement several central declared capabilities, including automatic task list generation, intelligent task decomposition, AI agent matching, or progress monitoring. Its actual primary purpose is a standalone priority calculation tool operating on input JSON files, which is materially narrower than the broader 'task management and execution coordination officer' description. No suspicious extra permissions or unrelated resource access are present, but the description overstates the implemented functionality enough to constitute a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description presents a broad intelligent task-management and execution-coordination system with planning, decomposition, agent assignment, and prioritization capabilities. The supplied code implements only a progress monitoring utility: it reads tasks from a JSON file, updates status timestamps, summarizes completion metrics, detects basic anomalies, and prints reports. While progress monitoring is consistent with part of the description, the primary declared capabilities are largely absent, making the description materially broader than the actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The code partially matches the declared description because it does generate task lists, decompose goals, and assign priorities. However, the broader declared purpose overstates the implementation. The script is a standalone task decomposition utility: it parses a goal, creates flat tasks, assigns heuristic priorities and time estimates, infers skill labels from keywords, and saves JSON output. It does not perform execution coordination, agent selection/dispatch, intelligent monitoring of progress, or broader task management workflows. No suspicious undeclared resource access or triggers are present, but the primary scope is narrower than the declared description.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding

The skill references local scripts and operational workflow that imply filesystem access, but it declares no explicit tool scope or permissions. In an orchestration skill, missing scope disclosure is risky because users and the runtime may not understand that the skill can read or write local task files such as tasks.json or report artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The description promotes automated decomposition, agent matching, execution, retry, and monitoring, but it does not warn users that the skill may trigger multi-step or multi-agent actions. Lack of upfront warning is dangerous because users may unknowingly authorize autonomous behavior, delegated actions, or file creation/modification in an orchestration workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The invocation triggers are broad enough to activate the skill for generic planning or collaboration requests, which can cause unintended task-running or orchestration behavior. In a multi-agent context, ambiguous activation increases the chance of the skill being invoked when the user expected advice only, potentially leading to unanticipated file operations or delegated execution.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/task_decomposer.py (reported line 102)May include surrounding context.

python
}
    
    def _add_task(self, task_data: Dict, parent_id: Optional[str] = None) -> str:
        """Add task to task list"""
        self.task_counter += 1
        task_id = f"T{self.task_counter}"

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This markdown file describes automatic matching of user task descriptions to agents such as web-search and content publishing tools, but it does not include any warning about potential privacy or external-action implications of sending user requests to those agents. Because SQP-2 applies to markdown files, the omission of user-facing disclosure about behaviors that may affect user data or system interactions is a relevant quality/safety gap.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The _save method writes the full task data back to the input file, and update_status invokes it automatically when a matching task is found. Although the CLI prints a success message after the update, there is no advance warning, confirmation, or explanatory comment/docstring disclosing that the provided input file will be modified in place.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The natural-language skill mapping explicitly routes tasks mentioning "Xiaohongshu" and "Official Account" to specific region/platform-oriented skills. This bakes in locale/platform assumptions without any visible opt-in, alternative, or explanation that the behavior is region-specific and intentional.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.