Task Dispatcher

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:55 AM UTC
• Version: 1.0.0

Overview

The skill is a broad task dispatcher, but its bundled cleanup rules can automatically move broad classes of project or user files to trash without confirmation.

Review this skill carefully before installing. Its dispatch and review workflow is coherent, but do not enable it as-is unless you are comfortable with broad automatic task routing, memory notes, cron-style behavior, and especially cleanup rules that should be disabled or restricted to an explicit task-owned directory with dry-run and confirmation required.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/config/cleanup.yaml:11
• Finding: Automatic Overbroad Cleanup Can Remove Unrelated User Files Without Confirmation## Vulnerability Details **File Location**: `references/config/cleanup.yaml:11-16, 48-59, 119-149, 223-232, 315-327`; conflicting safeguards in `SKILL.md:596-603` **Vulnerability Type**: Unsafe destructive file-cleanup configuration **Risk Level**: Medium ### Vulnerable Code ```yaml global: enabled: true cleanup_on_start: true # Cleanup at startup cleanup_on_complete: true # Cleanup after task completion cleanup_on_error: true # Cleanup after errors dry_run: false # Perform actual deletion log_deletions: true ``` ```yaml compilation_cache: patterns: - "**/.cache/" - "**/target/debug/" - "**/target/release/" - "**/.gradle/" - "**/.m2/" - "**/.npm/" - "**/.eslintcache" - "**/.tsbuildinfo" ``` ```yaml dev_tools_cache: patterns: - "**/.vscode/.cache/" - "**/.idea/caches/" - "**/.env.local" - "**/.env.*.local" retention: max_age_hours: 168 cleanup_strategy: "manual" ``` ```yaml media_cache: patterns: - "**/*.mp4" - "**/*.avi" - "**/*.mov" - "**/*.mp3" - "**/*.wav" - "**/*.jpg" - "**/*.png" - "**/*.gif" retention: max_age_hours: 24 max_size_mb: 5000 cleanup_strategy: "size_based" ``` ```yaml - name: "weekly_deep_cleanup" enabled: true schedule: "0 2 * * 0" categories: - "dev_tools_cache" - "test_artifacts" conditions: - type: "age" threshold_hours: 168 action: "delete" priority: 3 ``` ```yaml execution: max_parallel_deletes: 10 delete_batch_size: 100 require_confirmation: false large_file_threshold_mb: 100 move_to_trash: true ``` The configuration conflicts with the safeguards declared in `SKILL.md`: ```markdown | **Use trash** | Use the `trash` command instead of `rm` so recovery is possible | | **Preview before deletion** | Use `--dry-run` to list files pending deletion | | **Secondary confirmation** | Display the file list and require confirmation before deletion | | **R ...[truncated 4259 chars]
• Remediation: ## Remediation Suggestions 1. **Disable automatic destructive cleanup by default** ```yaml global: cleanup_on_start: false cleanup_on_complete: false cleanup_on_error: false dry_run: true ``` 2. **Require informed confirmation** ```yaml execution: require_confirmation: true move_to_trash: true ``` Display the complete resolved file list, total size, scan root, and reason for matching before accepting approval. 3. **Constrain cleanup to a task-specific root** - Require an explicit workspace path created for the current task. - Resolve the workspace and every candidate with canonical path resolution. - Reject candidates outside the canonical workspace. - Do not scan home directories, repository parents, system temporary roots, or arbitrary current working directories. 4. **Use an artifact ownership allowlist** - Track files created by the current task in a manifest. - Permit cleanup only for manifest entries or narrowly defined task-generated directories. - Do not infer ownership solely from filenames, extensions, age, or directory names. 5. **Remove sensitive and user-content patterns** - Remove `.env.local`, `.env.*.local`, and all credential or key patterns from cleanup categories. - Remove broad media patterns such as `**/*.png`, `**/*.jpg`, `**/*.mp4`, and `**/*.mp3`. - Restrict cache cleanup to caches created inside the task workspace. 6. **Preserve manual-category semantics** - Exclude `dev_tools_cache` from all scheduled and automatic rules. - Validate configuration at load time and reject any automatic rule referencing a category marked `manual`. 7. **Harden path processing** - Reject symlinks or verify both link and target remain inside the authorized root. - Prevent `..` traversal and filesystem mount-boundary crossing. - Avoid following junctions, bind mounts, and recursive links. - Apply deletion atomically where possible and handle race conditions be ...[truncated 573 chars]

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger language is extremely broad ('any user task', 'any multi-step work'), which makes the skill likely to activate for ordinary conversations and many unrelated requests. In combination with orchestration authority and downstream operational behaviors, overbroad matching increases the attack surface and the probability of unintended tool use, task interception, or execution of unsafe flows.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This configuration gives a task-dispatcher broad autonomous cleanup and deletion capabilities that are not tightly scoped to its stated orchestration role. Because cleanup is enabled on start, completion, and error with wide glob patterns, the skill could remove project data or user assets as a side effect of routine task handling, increasing the blast radius of any mistake or abuse.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The configured categories include deletion candidates such as media files and local environment override files, which are often user data or sensitive project configuration rather than disposable cache. In a task-dispatcher context, authorizing removal of these content types is overbroad and can cause data loss, broken deployments, or removal of developer-specific safeguards.

Credential Access

High

• Category: Privilege Escalation

Content

patterns:
      - "**/.vscode/.cache/"
      - "**/.idea/caches/"
      - "**/.env.local"
      - "**/.env.*.local"
    retention:
      max_age_hours: 168

• Confidence: 95% confidence
• Finding: Including .env.local and .env.*.local in cleanup targets is dangerous because these files frequently contain secrets, API keys, and machine-specific configuration. Even if the issue is deletion rather than theft, removing such files can disrupt deployments or local development and may pressure users to recreate secrets insecurely.

Credential Access

High

• Category: Privilege Escalation

Content

- "**/LICENSE*"
    - "**/README*"
    - "**/CHANGELOG*"
    - "**/.env"
    - "**/.env.production"
    - "**/secrets.yaml"
    - "**/credentials.json"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- "**/README*"
    - "**/CHANGELOG*"
    - "**/.env"
    - "**/.env.production"
    - "**/secrets.yaml"
    - "**/credentials.json"
    - "**/id_rsa*"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- "**/CHANGELOG*"
    - "**/.env"
    - "**/.env.production"
    - "**/secrets.yaml"
    - "**/credentials.json"
    - "**/id_rsa*"
    - "**/id_ed25519*"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- "**/.env"
    - "**/.env.production"
    - "**/secrets.yaml"
    - "**/credentials.json"
    - "**/id_rsa*"
    - "**/id_ed25519*"
    - "**/.aws/"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: SQP-3 适用于所有文件类型。文件描述与正文均以中文固定规定行为，但未说明仅面向中文用户，也未提供语言/locale 选择机制，构成潜在的语言策略违例。

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The skill says execution must wait for user confirmation, but other sections authorize automatic execution for LOW-risk tasks and immediate cleanup after completion. This policy contradiction is dangerous because it weakens the user-consent boundary and makes it more likely that actions with side effects occur without clear approval, especially in a skill intended to handle 'any task'.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is described as a dispatcher/coordinator, but it later expands its authority into direct workspace cleanup and deletion workflows. This creates scope creep: a broadly triggered orchestration skill could perform destructive file operations unrelated to the user’s primary request, increasing the chance of accidental data loss or abuse through prompt-driven task completion.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The documented cleanup behavior includes identifying and deleting broad classes of filesystem content such as logs, caches, build artifacts, temp databases, IDE files, and Docker-related data, even though the skill’s stated role is coordination. In a dispatcher with very broad triggering conditions, such deletion capability can be invoked inappropriately and may remove valuable or sensitive workspace state, causing integrity and availability issues.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The instruction to record key decisions into persistent memory can capture sensitive user inputs, operational context, file paths, credentials-adjacent data, or internal project details beyond the immediate task. Because this dispatcher is meant to handle broad categories of work, the retained data may be much more sensitive and varied than the author anticipates, creating unnecessary long-term exposure.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The document title and body are written in Chinese and do not indicate that language selection is optional or limited to a justified region-specific context. Under the language/locale policy, a skill should not force a specific language without user opt-in or clear documented justification.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# 确认要求
  confirm_requirements:
    auto_execute: [LOW]
    brief_confirm: [MEDIUM]
    detailed_confirm: [HIGH]
    explicit_authorization: [CRITICAL]

• Confidence: 90% confidence
• Finding: The configuration allows LOW-risk tasks to be auto-executed without user confirmation. In a task-dispatching skill that decomposes and routes arbitrary user requests, risk classification errors or ambiguous task interpretation can cause actions to be taken without explicit consent, increasing the chance of unintended side effects.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

business_rules:
  confirm_after_review:
    # 审核通过后的自动执行规则
    auto_execute_when:
      risk_level: LOW
      and:
        - review_passed: true

• Confidence: 92% confidence
• Finding: This rule explicitly permits automatic execution after review when a task is classified as LOW risk and passes review. In this skill's context, the dispatcher is an orchestration hub for multi-step agent actions, so review approval does not eliminate the danger of mis-scoped tasks, flawed risk labels, or reviewers missing downstream effects before autonomous execution occurs.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The file's human-readable comments and operator-facing messages are written in Chinese, which can impose a specific language on maintainers or users interacting with this skill configuration. The file does not provide an alternate locale, opt-in mechanism, or justification that this is a region-specific tool.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Automatic cleanup on start, completion, and error is enabled while dry-run is disabled, so deletion behavior can occur without an explicit user-facing checkpoint. This is dangerous because users may trigger routine task execution expecting orchestration only, but instead incur silent destructive actions in the workspace.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The configuration explicitly disables confirmation for deletion actions, including large files, removing an important safety barrier against accidental destructive operations. In combination with broad globbing rules, this increases the likelihood of significant unintended data loss before a user can review the targets.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The file uses Chinese-language comments and descriptions throughout, starting with the top-level configuration description, with no indication that language choice is configurable or user-selected. This can violate language/locale policy when a skill or its operational artifacts implicitly force one language without opt-in or justification.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The automatic pipeline selection is enabled and driven by broad criteria such as complexity_score, task_type, and risk_level without any defined scoring rules, trust boundaries, or validation constraints. In a task-dispatcher skill, this can cause unsafe or incorrect routing of user tasks into pipelines with different approval, review, timeout, and execution behaviors, potentially bypassing stricter handling for risky work or misallocating privileged agents.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This YAML file contains natural-language instructions and labels in Chinese, such as the top-level description and many inline comments, but does not indicate that Chinese is optional or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy, forcing a specific language without user opt-in is a policy concern.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: This YAML contains natural-language descriptions primarily in Chinese while operational identifiers and names are partly English, but it does not document any user language preference, opt-in, or locale selection. Under the language/locale policy criterion, this can be treated as an implicit locale choice rather than an explicitly user-selectable one.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: Natural-language comments such as the file description and section labels are presented only in Chinese, which can violate language-choice policy when no opt-in or locale justification is provided. This may make the skill inaccessible or inconsistent for users expecting a different default language.

Static analysis

No suspicious patterns detected.