Security audit
Security checks for vulnerabilities and agentic risk
Review recommended: the skill permits spending without an initial user-approved budget and automatically executes a downloaded installer.
Review the installer before running it and explicitly set a task spending budget before allowing paid calls, including polling. Browser account approval connects the account but does not define that budget. Share only necessary task data with providers. The supplied static scan reported no findings; the Review verdict rests on the documented installation and spending behavior.
The supplied commands submit API ratings rather than discover or invoke paid APIs. Rating endpoints is an undeclared feedback capability, and the chunk does not show it supporting a paid API call.
The supplied command submits feedback rather than discovering APIs or calling a paid capability. Although it uses the same service, feedback submission is a materially different action not described in the declared purpose. The code does not perform the searches mentioned in the feedback text.
The installer is fetched from a mutable remote URL and executed without a pinned version or independently verified integrity. HTTPS protects transport but does not protect against compromise of the publisher or distribution infrastructure, which could expose local files and account credentials.
command -v taskfuel || curl -fsSL https://taskfuel.ai/install.sh | sh
If ~/.local/bin is not on PATH, the installer says so — follow its hint.
Piping curl directly into sh turns remotely fetched content into local commands without an inspection or verification boundary. This confirms the same installer vulnerability identified by SC2 and SQP-2, rather than a separate demonstrated attack chain.
command -v taskfuel || curl -fsSL https://taskfuel.ai/install.sh | sh
If ~/.local/bin is not on PATH, the installer says so — follow its hint.
If the CLI is missing, the setup command immediately executes a remotely supplied script without reviewing or verifying its contents. A compromised distribution endpoint could execute arbitrary commands with the agent's local privileges; the missing warning compounds this risk but is not its root cause.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
After calling an endpoint, rate it with the same method and URL you called:
taskfuel rate https://api.example.com/search --vote up
taskfuel rate https://api.example.com/generate --method POST --vote down
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
taskfuel rate https://api.example.com/search --vote up
taskfuel rate https://api.example.com/generate --method POST --vote down
up if you got the expected/useful result; vote down if theThe skill supplies its own spending thresholds and directs the agent to spend below them without asking, including when a general task merely needs a capability the agent lacks. Quotes and per-call caps limit cost but do not establish user authorization to spend; the prepaid balance and cumulative approval rules reduce the exposure without resolving that authorization gap.
to pay. A `spec_unavailable` refusal is transient: retry the quote shortly.
- **Ask before big spends, and ask once**: a single call over $1, or a task
whose paid calls will add up to more than $5, needs the user's explicit OK
first. Below those lines, call without asking: the quote and the gateway's
hard cap already bound what a call can cost, and asking for every $0.10
call is what users complain about. An approval sticks for the session:
once the user has OK'd an endpoint at a quoted price, do not ask again for
No suspicious patterns detected.