Task Dispatcher

• Outcome: Review
• Latest audit: May 29, 2026 · 9:23 PM UTC
• Version: 1.0.0

Overview

This is mostly a disclosed task-orchestration skill, but its bundled cleanup rules can automatically delete broad local files without clear enough user control.

Review before installing. Use this only if you are comfortable with a central dispatcher sharing task context with subagents, and disable or rewrite cleanup first: turn off automatic cleanup, enable dry-run, require confirmation, remove .env and media patterns, and restrict deletion to explicitly approved task-created temporary paths.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is described as a task-dispatch and coordination hub, but it also embeds a post-task cleanup phase that identifies and removes broad classes of files, including build outputs, caches, logs, temp databases, IDE metadata, Docker artifacts, and system temp locations. In a dispatcher with authority over arbitrary user tasks, this expands its operational scope into destructive file operations that are not necessary for orchestration, increasing the chance of deleting useful or sensitive workspace data after unrelated tasks.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The cleanup section grants broad authority to delete or trash files across multiple categories and locations, despite the skill's stated purpose being dispatch and coordination. Because the skill claims applicability to essentially any task and can run after automated workflows, this creates an unjustified destructive capability that could be triggered in contexts where cleanup was never intended, causing data loss or interference with other projects.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The document says the task list must be shown to the user and confirmed before dispatch, but the risk table separately authorizes automatic execution for LOW-risk tasks. This policy conflict is dangerous because it gives the agent room to bypass confirmation based on its own risk classification, which may be wrong, especially for tasks that fan out to subagents or have hidden side effects.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The configuration classifies `.env.local` and `.env.*.local` as development-tool cache eligible for cleanup, even though such files commonly contain environment-specific secrets and local overrides. Automatically deleting them can break deployments, erase sensitive local configuration, and pressure operators to recreate secrets insecurely.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The `media_cache` category targets broad user-content extensions like `*.mp4`, `*.jpg`, and `*.png` anywhere in the filesystem via recursive globbing. For a task-dispatching skill, this is unrelated functionality and creates a substantial risk of destructive deletion of legitimate user data under automated cleanup rules.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: Enabling cleanup automatically on start, completion, and error turns a coordinator skill into an autonomous filesystem maintenance component. This broadens its operational scope and increases the chance that destructive actions occur without a user intentionally invoking cleanup behavior.

Vague Triggers

High

• Confidence: 85% confidence
• Finding: The skill advertises cron/heartbeat and periodic triggering without strong activation constraints or authorization boundaries. Automated invocation increases risk because actions may occur without an interactive user review cycle, which is especially problematic given the skill's broad delegation powers and embedded cleanup/execution logic.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The skill advertises cron/heartbeat and periodic triggering without strong activation constraints or authorization boundaries. Automated invocation increases risk because actions may occur without an interactive user review cycle, which is especially problematic given the skill's broad delegation powers and embedded cleanup/execution logic.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The file enables deletion on startup, completion, and error while `dry_run` is false, meaning real deletions can occur automatically without evidence of a user-facing warning or consent flow. In a general task-dispatcher context, this creates unsafe default behavior that can silently remove files during normal operations or failure handling.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The configuration explicitly disables confirmation for large-file deletion even though automated delete actions are configured elsewhere. This weakens a basic safety control and makes accidental destructive operations more likely, especially given the broad glob patterns in the file.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The automatic pipeline selection trigger is enabled and driven by loosely defined criteria such as complexity_score, task_type, and risk_level without specifying trusted sources, validation rules, thresholds, or authorization boundaries. In a task-dispatcher skill that routes work to subagents and can invoke higher-risk pipelines, this can lead to unintended or overly broad pipeline execution, incorrect escalation to powerful workflows, or abuse through crafted task metadata.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# 确认要求
  confirm_requirements:
    auto_execute: [LOW]
    brief_confirm: [MEDIUM]
    detailed_confirm: [HIGH]
    explicit_authorization: [CRITICAL]

• Confidence: 90% confidence
• Finding: auto_execute

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

business_rules:
  confirm_after_review:
    # 审核通过后的自动执行规则
    auto_execute_when:
      risk_level: LOW
      and:
        - review_passed: true

• Confidence: 92% confidence
• Finding: auto_execute

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.