ClawHub
Back to skill

Security audit

Tasktrove

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Tasktrove task-management purpose, but it needs review because it can send an API token over plain HTTP and documents task deletion without safeguards.

Review this skill before installing if your Tasktrove instance is remote or uses an API token. Prefer HTTPS-only TASKTROVE_HOST values, avoid sending tokens over plain HTTP, and require explicit user confirmation before any delete request.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/tasks.py:24
Finding

Bearer Token and Task Data Exposure over Plaintext HTTP

Content
View full analysis

Vulnerability Details

File Location: scripts/tasks.py:24-45; insecure HTTP configuration is also documented in SKILL.md:15
Vulnerability Type: Transmission of sensitive information over an unencrypted channel
Risk Level: Medium

Vulnerable Code

python
HOST = os.environ.get("TASKTROVE_HOST", "").rstrip("/")
TOKEN = os.environ.get("TASKTROVE_TOKEN", "")

if not HOST:
    print("Error: TASKTROVE_HOST environment variable is not set")
    print("Example: export TASKTROVE_HOST='http://localhost:3333'")
    sys.exit(1)

API = f"{HOST}/api/v1"


def _make_request(url, data=None, method="GET"):
    """Make an API request with optional auth."""
    headers = {"Content-Type": "application/json"}
    if TOKEN:
        headers["Authorization"] = f"Bearer {TOKEN}"
    
    req = urllib.request.Request(
        url,
        data=json.dumps(data).encode() if data else None,
        headers=headers,
        method=method
    )
    with urllib.request.urlopen(req, timeout=10) as resp:
        return json.load(resp)

The configuration documentation also recommends a plaintext endpoint:

bash
export TASKTROVE_HOST="http://your-server:3333"

Technical Analysis

The CLI accepts an arbitrary TASKTROVE_HOST URL without validating its scheme. When TASKTROVE_TOKEN is configured, _make_request places that secret in an HTTP Authorization: Bearer header regardless of whether the destination uses HTTPS.

Both the documentation and the missing-host error message demonstrate HTTP configurations. While loopback HTTP may be acceptable under a limited local deployment model, the documented http://your-server:3333 example encourages plaintext communication with a potentially remote server. HTTP provides neither transport confidentiality nor server authentication. A network-positioned attacker can therefore observe the bearer token and task content or tamper with requests and re ...[truncated 1481 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require https:// whenever TASKTROVE_TOKEN is present and terminate with a clear error if an authenticated plaintext URL is supplied.
  2. Reject remote HTTP endpoints by default. If HTTP is needed for local development, restrict it to explicit loopback destinations such as 127.0.0.1, localhost, or ::1.
  3. Provide a deliberate opt-in override for exceptional trusted development environments, accompanied by a prominent warning. Do not enable that override by default.
  4. Replace all remote HTTP examples in SKILL.md with HTTPS examples and document that bearer credentials must never be sent over plaintext transport.
  5. Preserve normal TLS certificate and hostname verification. Do not address this issue by disabling certificate validation.
  6. Consider validating the configured URL at startup, allowing only supported http or https schemes and rejecting embedded credentials, malformed URLs, and unexpected schemes.
  7. Rotate any token that may previously have been transmitted to a remote service over plaintext HTTP.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill performs sensitive capabilities involving environment variables and outbound network access, but the manifest does not declare an explicit tool scope or allowed-tools boundary. This weakens least-privilege controls and can allow the skill to access secrets like TASKTROVE_TOKEN and make arbitrary requests more broadly than users or the platform may expect.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

List Tasks

bash
curl -s "$TASKTROVE_HOST/api/v1/tasks"

Create Task

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest describes the skill as supporting listing, creating, completing, and updating tasks, but the documentation also exposes task deletion. This mismatch expands the operational surface beyond the declared behavior, increasing the risk that an agent may perform irreversible destructive actions users did not authorize or anticipate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documented DELETE operation is destructive and irreversible, yet it is presented as a normal API action without any caution, confirmation requirement, or guidance to verify user intent. In an agent setting, this increases the chance of accidental or prompt-induced data loss from ambiguous requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.