Security audit

Task Bot Orchestrator Free

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly describes ordinary file automation, but it also includes a contradictory production database sync example that could push an agent into high-impact data access beyond the stated free-version scope.

Review this carefully before installing. It is reasonable for CSV/Excel automation, scheduled reminders, and notifications, but do not grant database credentials or allow unattended production database actions based on this skill unless the publisher clarifies the contradiction, removes the DB example, and adds explicit approval and scoping controls for writes and outbound data sharing.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The skill is presented as a CSV/Excel automation tool, but the example expands it into database synchronization. That materially increases privilege expectations and the blast radius: an agent using this skill could access production data stores and move data between systems under a misleadingly narrow description.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: Direct database read/write capability is highly sensitive because it can expose, modify, or exfiltrate large volumes of production data. In the context of a lightweight task orchestrator, undocumented or unjustified DB access can mislead operators into granting excessive trust and permissions to an agent workflow.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The document states that the free version does not support database integration, yet earlier examples instruct database reads and writes. This contradiction is dangerous because users or downstream agents may rely on the more permissive example, causing unauthorized or unintended high-risk actions under false assumptions about the skill’s actual scope.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill supports file export, scheduled execution, email, and webhook delivery without prominently warning users about privacy, persistence, and external transmission risks. In an agent context, those capabilities can lead to unreviewed data disclosure, repeated automated actions, or unintended system impact if users are not clearly informed.

Static analysis

No suspicious patterns detected.