Security audit

NextCloud Deck Tracker

Security checks for vulnerabilities and agentic risk

Overview

This task-tracking skill is mostly coherent, but it overreaches by telling agents to track every user request externally and can send recurring notifications to a default named recipient.

Review before installing. Use this only with a NextCloud board intended for agent task tracking, avoid putting sensitive user prompts or credentials into card titles/descriptions, disable or override the default heartbeat recipient, and require confirmation before archiving, deleting, or using remote card contents for long-term memory.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: README.md:98
Finding: Unconditional External Tracking of User Requests
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:81
Finding: Heartbeat Notifications Default to an Unverified Third-Party Identity
Content: View full analysis
[target_id] ``` Spawns a background process that appends a "Still working..." log entry every 60 seconds. Additionally, it sends a chat notification to the specified `target_id` (defaults to Skander) every 120 seconds. The process terminates automatically when the card is moved out of the "In Progress" stack (to Done or Waiting). Use for tasks expected to take >2 minutes. ``` ### Technical Analysis The optional `target_id` defaults to the named identity “Skander.” The documentation does not establish that this identity represents the current user, an authorized administrator, or a recipient approved for the current task. Consequently, an agent following the documented command without an explicit recipient may initiate recurring outbound notifications to an unrelated identity. The background nature of the monitor increases the exposure because notifications continue every 120 seconds until the card leaves the “In Progress” stack. The executable implementation is absent from the audited artifact, so the exact notification transport and payload cannot be verified. Nevertheless, the documented default itself creates an unsafe agent instruction and a clear unintended-disclosure path. ### Attack Path 1. The agent creates or works on a card in the “In Progress” stack. 2. For a task expected to exceed two minutes, the agent runs `deck monitor ` without specifying `target_id`. 3. The monitor selects “Skander” as the default recipient. 4. A notification is sent every 120 seconds. 5. Notifications continue until the card is moved out of the progress stack. 6. The unintended recipient can infer task activity, timing, status, and potentially other notification content. ### Im ...[truncated 451 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:103
Finding: Untrusted Remote Card Content Is Directed Into Long-Term Memory
Content: View full analysis
progress "Finished step 1"`. 4. **Closing Task:** Use `deck update --description "Rich Summary"` to include **Technical Summary**, **Operations Performed**, and **Outcome**. 5. **Memory Synthesis:** Before archiving, use `deck dump-done` to parse the day's work and reinforce long-term memory. 6. **Daily cleanup** → `deck archive-done`. ``` ### Technical Analysis The workflow explicitly directs the agent to parse completed cards and use their contents to reinforce long-term memory. NextCloud card content is mutable remote data and may be controlled by other board users, compromised accounts, integrations, or imported content. No trust boundary, provenance validation, instruction filtering, or user approval is required before remote card text affects persistent memory. A malicious card can therefore contain false facts, behavioral directives, or prompt-injection content that becomes incorporated into state used by future sessions. This is distinct from ordinary task archiving: the stated objective is to make card content influence long-term memory, allowing the effects of attacker-controlled text to persist after the immediate interaction. ### Attack Path 1. An attacker obtains permission to create or edit cards on the relevant board, or compromises an integration with such permission. 2. The attacker places deceptive facts or agent-directed instructions in a card located in the completed stack. 3. The agent runs `deck dump-done` as required by the workflow. 4. Th ...[truncated 829 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: README.md:104
Finding: Predictable Shared Temporary Files Permit Disclosure and Symlink Attacks
Content: View full analysis
/tmp/desc.txt << 'EOF' My complex *markdown* here. EOF deck update --description "$(cat /tmp/desc.txt)" ``` From `SKILL.md`: ```bash # 1. Write rich description to temp file cat > /tmp/deck_desc_.txt << 'EOF' [Rich Markdown] EOF # 2. Update deck using the temp file deck update --description "$(cat /tmp/deck_desc_.txt)" ``` ### Technical Analysis The prescribed workflow writes potentially sensitive task descriptions to predictable paths in the globally shared `/tmp` directory. Neither example securely creates the file, restricts permissions, verifies that the path is a regular file owned by the current user, nor removes the file afterward. A local attacker can pre-create the expected path as a symbolic link. When the agent executes shell redirection, the shell follows the link and truncates or overwrites its target, subject to the agent account's filesystem permissions and operating-system symlink protections. The resulting temporary file may also inherit permissive mode bits based on the current `umask`, allowing other local users to read task descriptions. Because no cleanup is performed, sensitive content can remain on disk after the update completes. ### Attack Path 1. A local attacker predicts `/tmp/desc.txt` or derives `/tmp/deck_desc_.txt` from a known card identifier. 2. The attacker creates a symbolic link at that path pointing to a file writable by the agent account. 3. The agent follows the documented workflow and executes `cat >` on the predictable path. 4. Shell redirection follows the symbolic link and truncates or overwrites the linked file. 5. Alternatively, if a normal temporary file is created with permissive permissions, the attacker reads its task description. 6. ...[truncated 737 chars]
Remediation: View remediation
"$tmp_file" <<'EOF' My complex *markdown* here. EOF deck update --description "$(cat -- "$tmp_file")" ``` Additional hardening measures: 1. Never derive temporary filenames directly from card IDs or other predictable values. 2. Quote every reference to the generated path. 3. Verify that `mktemp` succeeds before writing. 4. Keep `umask 077` so only the current account can read the file. 5. Remove temporary content immediately after use through a shell trap. 6. Prefer passing the description through standard input or a dedicated `--description-file` option so sensitive content need not be loaded into command arguments. 7. Ensure the CLI implementation does not log descriptions or expose them through process listings. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented delete command permanently removes cards but provides no warning about irreversibility, no advice to confirm card identity, and no safer alternative such as archiving first. In a task-tracking skill used by agents, a mistaken card_id or automated invocation could delete active work records, causing direct data loss and disrupting auditability and workflow continuity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README instructs AI agents to 'track everything' and make deck add ... --progress the first action for any user request, which can cause user prompts, task details, filenames, or other sensitive context to be transmitted to a third-party NextCloud instance by default. Because there is no warning, consent gate, or guidance to minimize/redact content before syncing, this creates a real privacy and data-handling risk rather than a purely theoretical issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill documents an archive operation that changes task state in bulk without any warning that the action is destructive or guidance to verify targets before running it. In an automation-oriented agent context, undocumented destructive behavior increases the chance of accidental mass data loss or loss of operational visibility, especially if invoked from habit or scripts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.