Security audit
Security checks for vulnerabilities and agentic risk
This Teambition skill is coherent overall, but it can modify shared project data and reveal member/profile details with safeguards that are not consistently scoped.
Review this skill before installing if your Teambition workspace contains sensitive business data. Prefer an environment variable or secret manager for the token, do not commit user-token.json, use the least-privileged account available, and require explicit confirmation before task archive/restore, sprint start/complete, project archive/unarchive, bulk updates, or file uploads. Be aware that member/profile queries may print email, phone, employee number, signed file links, and detailed task or project data into logs or transcripts.
The skill implements sprint lifecycle management (manage_sprint.py create/start/complete) while the top-level description focuses on tasks and projects and does not clearly advertise iteration management. Under-declared project-lifecycle actions can surprise users and reviewers because they can alter planning state across a team, not just a single task.
The skill implements sprint lifecycle management (manage_sprint.py create/start/complete) while the top-level description focuses on tasks and projects and does not clearly advertise iteration management. Under-declared project-lifecycle actions can surprise users and reviewers because they can alter planning state across a team, not just a single task.
The skill implements sprint lifecycle management (manage_sprint.py create/start/complete) while the top-level description focuses on tasks and projects and does not clearly advertise iteration management. Under-declared project-lifecycle actions can surprise users and reviewers because they can alter planning state across a team, not just a single task.
The manifest limits the skill to Teambition tasks and projects with specific operations like querying tasks, updating task fields, uploading files, checking members, and querying projects. The README additionally claims support for iteration/sprint lifecycle operations and project member management, which are not reflected in the manifest description and therefore expand the described behavior beyond the declared scope.
This markdown file documents operations such as creating, updating, archiving tasks, managing members and sprints, adding comments/progress, and uploading attachments, all of which can modify user or project data. The description presents these capabilities as features but does not include warnings about data impact, reversibility, or the need to verify targets before execution.
The credential setup instructions tell users to place a Teambition user token in an environment variable or local JSON file without any warning about secret handling, file permissions, or avoiding commits to source control. Because this token likely grants access to tasks and projects, careless storage can lead to credential leakage and unauthorized access to enterprise data.
The skill requires environment access for TEAMBITION_USER_TOKEN, local file access for user-token.json and uploads, and network access to Teambition APIs, but it does not declare any explicit tool scope or allowed-tools boundary. This weakens least-privilege enforcement and makes it easier for a host agent to grant broader capabilities than the skill actually needs, increasing the blast radius if the skill is misused or modified.
The natural-language instructions for using the skill are presented entirely in Chinese from the main documentation onward. Under the policy, forcing a specific language without offering the user a choice or documenting a justified locale constraint is a policy violation.
The document title and all guidance are written exclusively in Chinese, with no indication that other languages are supported or that the Chinese-only constraint is intentional and justified. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The documentation exposes project-level archive/unarchive operations that are broader and more destructive than the skill's stated task/project assistance scope, creating a scope-expansion risk. In an agent setting, documented commands are often treated as available actions, so this can enable unintended high-impact project changes if invoked without explicit user intent and confirmation.
The markdown documents archive/unarchive endpoints without any caution that these are project-wide state-changing operations, which increases the chance an agent or operator will treat them as routine updates. Because archiving can disrupt team access and workflows, the lack of warning and confirmation guidance makes accidental misuse more likely in this skill context.
The manifest describes checking todos, creating/updating tasks, marking tasks done, querying projects/members, commenting, file upload, and tracking task progress. This file additionally documents archiving and restoring tasks, which are state-management capabilities not declared in the manifest description and expand the skill’s operational scope.
The document describes destructive or state-changing operations such as archive, restore, and marking tasks done/undone without any caution, confirmation guidance, or user-consent safeguards. In an agent setting, this can encourage automation that performs irreversible or workflow-disruptive changes based on ambiguous user requests or mistaken task selection.
The manifest lists supported actions such as checking todos, creating tasks, updating task status/priority/assignee/note, marking tasks done, commenting, uploading files, and tracking progress, but it does not mention archiving or restoring tasks. This file is explicitly dedicated to task archival/restoration, introducing behavior beyond the described skill scope.
The script performs immediate remote state-changing operations against the Teambition API to archive or restore a task, with no confirmation, dry-run mode, or safety interlock before execution. In an agent context, this increases the risk of unintended destructive changes from ambiguous prompts, misrouted task IDs, or automation mistakes, especially because archiving can hide active work and disrupt team workflows.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
h = _headers()
if headers:
h.update(headers)
resp = requests.post(url, headers=h, json=body or {}, timeout=30)
return _handle(resp)
def put(path: str, body: Optional[Dict[str, Any]] = None, headers: Optional[Dict[str, str]] = None) -> Dict[str, Any]:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
h = _headers()
if headers:
h.update(headers)
resp = requests.put(url, headers=h, json=body or {}, timeout=30)
return _handle(resp)
When member lookup returns multiple matches, the code prints each candidate's email address to stderr. This exposes personally identifiable information beyond what is necessary to resolve an assignee ambiguity, and could leak team-directory data to users or logs not authorized to view member emails. In a task-management skill, listing names or opaque IDs may be justified, but disclosing email addresses is excessive for the stated purpose.
This code file contains natural-language documentation and CLI help entirely in Chinese, including the module docstring and all help/error text. Under the stated policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy violation.
The file’s docstring and implementation clearly create a Teambition task progress update via v3/task/{task_id}/trace/create. The manifest lists task creation, updates to status/priority/assignee/note, comments, file upload, and progress tracking, but it does not state that the skill can create progress/trace entries; 'track task progress' reads as viewing/querying progress rather than writing a new progress record.
The module docstring is entirely in Chinese, and the script's help and error messages are also Chinese-only, which imposes a specific language on users without offering a language choice. This matches the policy category for language or locale constraints that are not opt-in or explicitly justified.
The script calls /users/me and exposes current-user profile data, which goes beyond the skill manifest's stated task/project operations scope. In an agent-skill context, unnecessary identity/profile collection expands the data-access surface and may surprise users or downstream tooling that expects only task-management actions.
The script prints sensitive profile attributes including email, phone, and employee number directly to stdout and as formatted JSON without any explicit privacy warning, masking, or need-to-know restriction. In agent environments, stdout may be logged, surfaced to other components, or retained in transcripts, turning a simple profile lookup into avoidable PII disclosure.
The module docstring and command-line help are entirely in Chinese, which imposes a specific language on users. The file does not offer an opt-in language selection or explain that the skill is intended only for a Chinese-speaking or region-specific context.
This Python file contains all user-facing natural-language strings, including the module docstring and CLI help output, exclusively in Chinese. Under the stated policy, forcing a specific language without opt-in or documented regional justification is a natural-language policy violation.