Security audit

task-time-manager

Security checks for vulnerabilities and agentic risk

Overview

The task planner includes a persistent, generic learning system that can record user preferences/history and change skill behavior beyond normal task management.

Install only if you are comfortable with this skill keeping local records of usage, errors, notes, and preferences, and with its learner being able to target other skill directories when invoked that way. Before approval, the publisher should scope storage to this skill, remove unrelated learning examples, add opt-in and deletion controls, and avoid self-modifying SKILL.md behavior.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a task and time management assistant, but it also documents a generic cross-skill learning/persistence system that records usage counts, failures, error patterns, and user preferences. This expands behavior beyond the stated purpose and can enable covert profiling and retention of data unrelated to the user’s immediate task, increasing privacy and trust risks.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The added self-evolving learning system introduces persistent state and behavior modification beyond the advertised planning workflow. That makes the skill more dangerous because a seemingly simple productivity assistant can silently accumulate history and alter future outputs based on retained data.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Automatic profiling of user preferences, failures, and history is not clearly necessary for basic task planning. Even if intended to improve usability, collecting this data without tight justification can create privacy exposure, inference of sensitive habits, and secondary use of information beyond the original interaction.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The examples show the learner recording unrelated capabilities such as resume optimization and price comparison, suggesting the module is generic and not scoped to this skill. That inconsistency increases concern that the skill may be used as a vehicle for broader telemetry or behavior not expected from a task manager.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The module is explicitly designed as a cross-skill learner that records usage history, errors, notes, and user preferences for arbitrary skills, which exceeds the declared scope of a task/time-management assistant. This creates unnecessary data collection and cross-context persistence risks, especially because notes and preferences may contain sensitive user information unrelated to this skill.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The implementation does not provide task/time-management features; instead it acts as a generic behavior and preference recorder. This mismatch increases security risk because users and reviewers may grant trust based on the advertised skill purpose while the code performs broader tracking functionality.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The resolve_skill_dir logic accepts any directory path or any skill name under ~/.workbuddy/skills, allowing this script to read and write learned_patterns.json for other skills rather than being confined to its own directory. In a multi-skill environment, this breaks isolation boundaries and could enable unauthorized modification of telemetry, preferences, or operational history across skills.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger list includes broad everyday phrases such as planning and efficiency improvement, which can cause accidental invocation in contexts where the user did not intend to use this skill. Because the skill also has write capabilities and documented persistence behavior, unintended activation becomes more sensitive than it would be for a read-only helper.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill states that it persists user preferences and usage history across sessions but does not provide a clear warning, consent flow, or retention disclosure. Silent persistence is dangerous because users may reveal schedules, habits, priorities, and work patterns assuming the interaction is ephemeral.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Persisting user preferences and usage history across sessions creates a natural-language data retention risk, especially for a task-management skill that may process schedules, priorities, deadlines, and personal work habits. If that file is exposed, reused, or repurposed, it can leak sensitive behavioral data beyond the original session.

Static analysis

No suspicious patterns detected.