Security audit
Security checks for vulnerabilities and agentic risk
TaskSquad is a coherent remote-agent collaboration skill, but it asks users to install and run a daemon that can execute remotely assigned local tasks with under-scoped safety guidance.
Review before installing. Only use this with a TaskSquad account and agents you trust, avoid curl-to-bash installation unless you can verify the installer, treat tokens as secrets, run the daemon as a low-privilege user in a limited working directory, and assume task logs and live streams may reveal sensitive local agent output.
SKILL.md:24Unverified Remote Script Downloaded and Executed by Bash
SKILL.md:18Unpinned CLI Installation from a Third-Party Homebrew Tap
The installation instructions recommend piping a remotely fetched script directly into bash without any integrity verification, review step, or safety warning. This is dangerous because a compromised install host, DNS/TLS issue, or malicious script update would immediately execute arbitrary code on the user's system.
Fetching an install script from a remote host and executing it immediately is a classic unsafe pattern because it grants arbitrary code execution to the remote source at install time. Users are given no opportunity to verify script contents, origin integrity, or version, making supply-chain compromise especially impactful.
Using installation script (macOS/Linux/Windows):
curl -sSL install.tasksquad.ai | bash
The explicit shell chaining operator into bash converts remote content retrieval directly into command execution, removing any review boundary between download and run. In a skill that already enables remote agent orchestration, normalizing this pattern increases the chance of users accepting unsafe execution flows and suffering full host compromise if the upstream source is malicious.
Using installation script (macOS/Linux/Windows):
curl -sSL install.tasksquad.ai | bash
The skill states that the daemon pulls tasks from a central portal and that the agent executes them locally, but it provides no explicit warning that remote task content can cause code or command execution on the user's machine. In this context, omitting that warning is dangerous because the core feature is remote-to-local task execution, which materially increases risk of arbitrary action, data access, or system compromise if tasks are malicious or misrouted.
The skill tells users to obtain a token from the browser but gives no warning that the token is a sensitive credential or guidance on secure handling. This is dangerous because users may paste the token into logs, shell history, shared terminals, or unsecured files, enabling account or agent takeover.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Create a new team in your account.
curl -X POST "https://api.tasksquad.ai/teams" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"name": "My Team"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Create a new team in your account.
curl -X POST "https://api.tasksquad.ai/teams" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"name": "My Team"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Create a new team in your account.
curl -X POST "https://api.tasksquad.ai/teams" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"name": "My Team"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Create a new team in your account.
curl -X POST "https://api.tasksquad.ai/teams" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"name": "My Team"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Create a new team in your account.
curl -X POST "https://api.tasksquad.ai/teams" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"name": "My Team"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Create a new team in your account.
curl -X POST "https://api.tasksquad.ai/teams" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"name": "My Team"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Create a new team in your account.
curl -X POST "https://api.tasksquad.ai/teams" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"name": "My Team"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Create a new team in your account.
curl -X POST "https://api.tasksquad.ai/teams" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"name": "My Team"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Create a new team in your account.
curl -X POST "https://api.tasksquad.ai/teams" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"name": "My Team"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Create a new team in your account.
curl -X POST "https://api.tasksquad.ai/teams" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"name": "My Team"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Create a new team in your account.
curl -X POST "https://api.tasksquad.ai/teams" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"name": "My Team"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Create a new team in your account.
curl -X POST "https://api.tasksquad.ai/teams" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"name": "My Team"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Create a new team in your account.
curl -X POST "https://api.tasksquad.ai/teams" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"name": "My Team"}'
The live-streaming and task-log features are presented without warning that they may expose agent output, prompts, filesystem paths, secrets, or other sensitive operational data to remote viewers. In an agent-execution skill, such telemetry can leak confidential information well beyond what users expect.