Task Orchestra

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:02 PM UTC
• Version: 1.0.0

Overview

The skill mostly describes normal task orchestration, but it asks for an unexplained API key and installs an unpinned npm package that is not clearly needed.

Review this before installing. The orchestration guidance itself is coherent, but only provide `BRAVE_API_KEY` if you understand why the skill needs Brave access, and prefer a version-pinned or removed npm dependency before using it in an environment with sensitive files or credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Third-Party npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–15
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Configuration:

yaml

install:
  - id: npm
    kind: node
    package: async
    bins: ["async"]

Technical Analysis

The skill declares installation of the npm package async without an exact version, lockfile, or integrity hash. Consequently, installation can resolve mutable package-registry content rather than a previously reviewed artifact. This prevents reproducible installation and creates exposure to future package compromise, malicious release publication, registry-account takeover, or unexpected dependency changes.

The declaration should also be validated because async is commonly consumed as a Node.js library, while the configuration expects an async executable. A mismatch between the intended package and declared binary increases the risk of installing an unnecessary or incorrectly selected component.

No evidence establishes that the current async package release is malicious. The vulnerability is the unsafe, unpinned supply-chain configuration.

Attack Path

1. An attacker compromises the selected npm package, one of its transitive dependencies, or the relevant publisher account, and publishes a malicious release.
2. The skill installer resolves the package name without an exact version or verified integrity value.
3. npm downloads the attacker-controlled release during installation.
4. Malicious package content or applicable lifecycle behavior executes in the installation environment.
5. The payload operates with the privileges and accessible environment of the process installing the skill.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installer’s account. Depending on that account’s permissions, the payload could access project files, environment variables, API c ...[truncated 278 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to an audited exact version rather than relying on registry resolution of an unspecified release.
• Use a committed lockfile and verify package integrity with trusted checksums or npm integrity metadata.
• Review direct and transitive dependencies before release and continuously monitor them for compromise or known vulnerabilities.
• Disable npm lifecycle scripts during installation where they are not required.
• Verify that the selected package actually provides the declared async binary and is necessary for the documented orchestration functionality.
• Remove the dependency entirely if the skill does not invoke it.
• Install dependencies in a least-privileged, isolated environment without unrelated secrets such as BRAVE_API_KEY.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest declares a required environment variable, BRAVE_API_KEY, which indicates the skill depends on a credential. While the file describes orchestration behavior, it does not include any user-facing warning or note about accessing or handling API keys, which is relevant for privacy and safety expectations in markdown/manifest content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.