Task Bot Orchestrator Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.0.0

Overview

The skill is mostly an automation guide, but its free-version boundaries are inconsistent and it can trigger file changes, recurring tasks, notifications, and even database writes without clear safeguards.

Review this skill before installing. Use it only for clearly scoped file-processing, scheduling, and notification tasks; do not let it access databases unless you separately approve least-privilege credentials and the exact query/write target. Confirm output paths, recipients, webhook URLs, and recurring schedules before execution, and install dependencies in an isolated environment with pinned versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:371

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:68 and SKILL.md:371-374
Vulnerability Type: Supply-chain exposure through unpinned dependencies
Risk Level: Medium

Vulnerable Code

At SKILL.md:68:

bash

# Dependency installation
pip install pandas openpyxl schedule

At SKILL.md:371-374:

markdown

| pandas | Python library | Required | `pip install pandas` |
| openpyxl | Python library | Required | `pip install openpyxl` |
| schedule | Python library | Required | `pip install schedule` |
| secure-smtplib | Python library | Optional | `pip install secure-smtplib` (email notification) |

Technical Analysis

The Skill instructs an Agent with exec access to install third-party Python packages without exact version constraints, cryptographic hashes, a lockfile, an isolated environment, or an explicitly trusted package index. Package installation may execute package-controlled build or installation logic with the privileges of the Agent process.

Mutable dependency resolution means the effective code installed during a future invocation can differ from the code available when this Skill was audited. If a package release, dependency, configured package index, or similarly named package is compromised, installation could introduce attacker-controlled code. The project also provides no implementation or provenance documentation establishing why the optional secure-smtplib package is required.

This finding does not establish that any currently named package is malicious. The vulnerability is the unsafe and non-reproducible dependency installation process.

Attack Path

1. An Agent loads the Skill and follows its documented setup procedure.
2. Because the Skill permits exec, the Agent runs the unpinned pip install command.
3. pip resolves the latest acceptable packages and transitive dependencies from the configured package index.
4. An attacker compromises a resolved ...[truncated 1070 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct and transitive dependency to a reviewed version using a lockfile or fully constrained requirements file.
2. Require cryptographic hashes, for example with pip install --require-hashes -r requirements.txt.
3. Install dependencies inside a dedicated virtual environment or disposable sandbox rather than the Agent's global Python environment.
4. Configure and document a trusted package index; reject unexpected extra indexes and untrusted mirrors.
5. Review package provenance, maintainers, release history, and transitive dependencies before approval.
6. Remove secure-smtplib unless its provenance and necessity are verified. Prefer Python's standard-library smtplib where it satisfies the requirement.
7. Run dependency installation and task execution as a non-privileged account with restricted filesystem and network access.
8. Add automated dependency scanning and controlled update review so version changes cannot silently alter the installed code.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill claims the free edition only supports file processing, yet an example shows direct database read/write synchronization. This inconsistency can mislead an agent into attempting higher-risk operations than users expect, including access to production data stores and unintended modification of external systems.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The 'Known Limitations' section says database integration is unsupported, but earlier content demonstrates database reads and writes. Contradictory guidance is dangerous because agents may follow the executable-looking example instead of the restriction, causing unauthorized access or writes to sensitive systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document advertises exporting files, scheduling recurring tasks, and sending notifications, all of which change system or data state, but it does not require user confirmation or present risk warnings. That omission can cause agents to perform persistent or external side effects without the user's informed approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Email and webhook capabilities enable data exfiltration or disclosure to third-party endpoints, yet the documentation provides no privacy, destination validation, or secret-handling guidance. In a tool-enabled agent, this makes accidental leakage of sensitive content more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill's applicability language is overly broad, covering generic efficiency and automation scenarios without clear trigger boundaries. In an agentic environment with exec access, this increases the chance of accidental invocation for unrelated requests, leading to unreviewed file changes, scheduling, or outbound actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

L398写明‘完全中文化表达，适配中文用户效率场景’，体现出技能在语言呈现上预设为单一中文环境。文档中未见为用户提供语言切换、语言偏好继承或显式选择机制，因此可能不符合要求尊重用户语言/地区偏好的组织策略。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.