pikpak-task-guardian

• Outcome: Pass
• Latest audit: Oct 18, 2026 · 4:04 PM UTC
• Version: 1.0.8

Overview

The skill is a disclosed PikPak task monitor with opt-in notifications and limited resubmission behavior, but users should only run it in a trusted local environment.

Install only if you trust the local PikPak CLI, PATH/PIKPAK_BIN, Python interpreter, and the private state directory you provide. Keep resubmission disabled unless you have a precise source registry, review unknown/submitting states manually, and note that the referral code is disclosed and optional.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Direct flow: os.environ.get (credential/environment) → subprocess.run (code execution)

High

• Category: Data Flow
• Confidence: 97% confidence

Finding

There is a direct trust-boundary violation from environment-controlled input to process execution: PIKPAK_BIN determines which executable is launched. In an agent or automation context where environment variables may be influenced by a caller, wrapper, or compromised runtime, this enables arbitrary command execution and credential theft via a trojan replacement binary.

Content

Scanner excerpt · scripts/task_guardian.py (reported line 283)May include surrounding context.

python

def pikpak_json(*args, timeout=120):
    try:
        proc = subprocess.run([os.environ.get("PIKPAK_BIN", "pikpak"), *args, "-F", "json"],
                              capture_output=True, text=True, timeout=timeout)
    except (OSError, subprocess.TimeoutExpired):
        return None, safe_failure(kind="transport")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill describes and instructs use of shell execution, environment inheritance, and file read/write behavior, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens policy enforcement and reviewability: an agent may invoke broader capabilities than a user or host expects, increasing the risk of unintended command execution, state-file access, or environment/token exposure.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 92% confidence

Finding

This subprocess invocation executes a program path taken directly from the PIKPAK_BIN environment variable. Although shell injection is avoided by using an argument list, an attacker who can influence the environment can cause the script to execute an arbitrary binary in place of the expected PikPak CLI, which is code execution in the script's trust context.

Content

Scanner excerpt · scripts/task_guardian.py (reported line 283)May include surrounding context.

python

def pikpak_json(*args, timeout=120):
    try:
        proc = subprocess.run([os.environ.get("PIKPAK_BIN", "pikpak"), *args, "-F", "json"],
                              capture_output=True, text=True, timeout=timeout)
    except (OSError, subprocess.TimeoutExpired):
        return None, safe_failure(kind="transport")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/task_guardian.py (reported line 303)May include surrounding context.

python

safe_message = display_text(message, 120)
    if sys.platform == "darwin":
        try:
            proc = subprocess.run(["osascript", "-e", NOTIFICATION_SCRIPT, "--", safe_title, safe_message],
                                  capture_output=True, text=True, timeout=10)
            if proc.returncode == 0:
                return True

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file contains user-facing natural-language instructions and descriptions exclusively in Chinese. Under the policy rule, forcing a specific language without giving users a choice can be a locale/language policy violation unless the restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.