ClawHub
Back to skill

Security audit

Vikunja Fast

Security checks for vulnerabilities and agentic risk

Overview

This Vikunja task helper is mostly coherent, but it should be reviewed because it can send credentials or bearer tokens to a user-configured URL without requiring HTTPS and can modify task state.

Install only if you will configure a trusted HTTPS Vikunja URL and a narrowly scoped token where possible. Avoid username/password fallback unless necessary, rotate credentials if they may have been used over HTTP, and require explicit user intent before running the done command because it changes remote task data.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
vikunja.sh:6
Finding

Vikunja Credentials and Bearer Tokens Can Be Transmitted over Plaintext HTTP

Content
View full analysis
Remediation
View remediation
&2 exit 2 ;; esac ``` 2. If non-TLS HTTP is required for a development environment, require an explicit opt-in variable such as `VIKUNJA_ALLOW_INSECURE_HTTP=1`. Keep the default secure and display a prominent warning when the override is active. 3. Document that usernames, passwords, JWTs, and task information must only be sent over HTTPS, except for carefully controlled loopback-only development deployments. 4. Use a narrowly scoped Vikunja API token where supported instead of an account password or broadly privileged token. Grant the token only the project and task permissions required by this Skill. 5. Prefer short-lived tokens and provide operational guidance for token revocation and credential rotation following suspected exposure. 6. Retain normal TLS certificate verification. Do not add `curl -k` or `--insecure`, because those options would allow an on-path attacker to impersonate the Vikunja server even when an HTTPS URL is configured. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The code is clearly focused on Vikunja task access via the API: it authenticates, queries /tasks/all with filters for overdue and due-today, supports arbitrary filtered task listing, fetches individual task details, and updates a task to done. This substantially aligns with the task-oriented portion of the description, including overdue/due/today-style summaries and marking done. However, the declared purpose says 'Manage Vikunja projects and tasks,' which overstates project capabilities: the script only calls /projects to build an ID-to-title map for output formatting and does not manage projects. Additionally, the actual code lacks any project CRUD or broader project operations. There is also an internal inconsistency: the help text advertises 'due-week' but the command is not implemented. Overall, this is a partial mismatch because the project-management claim is not supported and the exposed functionality is narrower than described.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill documents shell-based actions using curl and jq but does not declare any tool scope restrictions such as allowed-tools or permissions. That increases risk because an agent may execute shell commands with broader capabilities than intended, including commands that transmit credentials or modify remote state. In an agent setting, undeclared shell capability is a meaningful security control gap.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation presents a task-completion POST request without prominently warning that it changes remote task state. In an agent workflow, this can lead to accidental modification of production task data if the agent treats examples as safe defaults or executes them without explicit user confirmation. The context makes this more dangerous because the skill is designed for authenticated API access to a real task system.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

bash
TASK_ID=123

curl -fsS -X POST "$VIKUNJA_URL/tasks/$TASK_ID" \
  -H "Authorization: Bearer $VIKUNJA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"done": true}' | jq

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
fi

  # Request a JWT
  VIKUNJA_TOKEN=$(curl -fsS -X POST "$VIKUNJA_URL/login" \
    -H "Content-Type: application/json" \
    -d "{\"username\":\"$VIKUNJA_USERNAME\",\"password\":\"$VIKUNJA_PASSWORD\",\"long_token\":true}" \
    | jq -r '.token // empty')

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · vikunja.sh (reported line 56)May include surrounding context.

sh
fi

  # Request a JWT
  VIKUNJA_TOKEN=$(curl -fsS -X POST "$VIKUNJA_URL/login" \
    -H "Content-Type: application/json" \
    -d "{\"username\":\"$VIKUNJA_USERNAME\",\"password\":\"$VIKUNJA_PASSWORD\",\"long_token\":true}" \
    | jq -r '.token // empty')

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · vikunja.sh (reported line 70)May include surrounding context.

sh
api_get() {
  local path=$1
  ensure_token
  curl -fsS "$VIKUNJA_URL$path" -H "Authorization: Bearer $VIKUNJA_TOKEN"
}

api_post_json() {

Static analysis

No suspicious patterns detected.