Vikunja

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:15 AM UTC
• Version: 1.0.2

Overview

This skill is a disclosed Vikunja task-management integration that uses an API token to read and modify tasks, with no evidence of hidden code, persistence, or unrelated data access.

Install only if you want this agent to operate on your Vikunja instance using the configured API token. Use a token scoped as narrowly as Vikunja allows, and confirm before deletes or removals because the skill can change task data, labels, assignees, reminders, and relations.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

This skill exposes a raw task-deletion operation with a user-controlled taskID and no accompanying guardrails in the reference for confirmation, scoping, or identity validation. In an agent setting, that increases the chance of parameter abuse, where a prompt or misunderstanding causes deletion of the wrong task or unauthorized destructive action within the authenticated user's scope.

Content

Scanner excerpt · references/endpoints.md (reported line 130)May include surrounding context.

Delete a task

text

DELETE /tasks/{taskID}

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

This endpoint allows direct removal of a label from a task using attacker- or user-supplied identifiers, and the documentation provides no guardrails on how an agent should bind those IDs to the user's intended objects. In an LLM-driven workflow, that can lead to parameter confusion or malicious prompting that strips important labels from unrelated tasks.

Content

Scanner excerpt · references/endpoints.md (reported line 195)May include surrounding context.

Remove a label from a task

text

DELETE /tasks/{taskID}/labels/{labelID}

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Removing assignees is a state-changing operation keyed entirely by taskID and userID, and the reference does not specify any validation or confirmation flow. In an agent context, this creates a realistic parameter-abuse risk where the wrong user is unassigned or a prompt tricks the agent into altering task accountability unexpectedly.

Content

Scanner excerpt · references/endpoints.md (reported line 219)May include surrounding context.

Remove an assignee

text

DELETE /tasks/{taskID}/assignees/{userID}

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

This relation-deletion endpoint accepts multiple user-influenced parameters, including relationKind, making it susceptible to parameter abuse if an agent misresolves task identities or relation types. In project-management workflows, deleting the wrong dependency can disrupt planning and execution even if the underlying API authorization is correct.

Content

Scanner excerpt · references/endpoints.md (reported line 248)May include surrounding context.

md

Response: objeto con task_id, other_task_id, relation_kind, created_by, created.

### Delete a relation
DELETE /tasks/{taskID}/relations/{otherTaskID}/{relationKind}


## Error responses

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to activate this skill for generic task-management requests that do not explicitly mention Vikunja. That can cause the agent to route user requests into a capability that performs authenticated actions against a real external task system, increasing the chance of unintended data access or modification.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

## Workflow guidelines

1. **Resolve names to IDs first.** If the user says "add a task to my Work
   project", list projects and find the ID for "Work" before creating the task.
2. **Confirm destructive actions.** Before deleting a task or project, confirm
   with the user.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file documents task deletion via DELETE /tasks/{taskID} but does not warn that the action is destructive or potentially irreversible. Under the markdown-file criteria for SQP-2, skills should disclose behaviors that could affect user data or system integrity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The relation_kind descriptions are written in Spanish (esta tarea va antes..., objeto con...) while the rest of the file is in English, and the document does not offer the user a language or locale choice. This creates a natural-language locale inconsistency that fits the policy-violation criterion for forced language without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file documents DELETE /tasks/{taskID}/labels/{labelID} without any user-facing warning that it changes task metadata. Even though this is less severe than task deletion, it still alters user-managed data and the markdown description does not disclose that effect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The endpoint DELETE /tasks/{taskID}/assignees/{userID} changes who is assigned to a task, but the markdown provides no warning that it modifies collaboration state. For markdown skills, actions affecting user data or workflow should be disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

Deleting a task relation modifies dependency metadata that can affect planning and workflow, yet no warning is provided. This is a data-affecting operation in the markdown reference and should be disclosed to users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.