T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:4- Finding
Mutable Remote Executable Is Downloaded and Trusted Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
taskleef
Security checks for vulnerabilities and agentic risk
Overview
This Taskleef skill is coherent, but it needs Review because it installs an unpinned external CLI that will use the user's API key and it documents destructive task commands without confirmation guidance.
Install only if you trust the upstream Taskleef CLI source and are comfortable giving it your Taskleef API key. Prefer a pinned release or verified checksum before execution, avoid running setup as root, and require explicit confirmation with exact IDs before delete, project delete, or board clear actions.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md brew install jq # Ubuntu/Debian sudo apt-get install jq # CentOS/RHEL sudo yum install jq
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md brew install jq # Ubuntu/Debian sudo apt-get install jq # CentOS/RHEL sudo yum install jq
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
cd taskleef/taskleef-cli chmod +x todo
Add to PATH (add to ~/.bashrc or ~/.zshrc)
export PATH="$PATH:/path/to/taskleef/taskleef-cli"
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README explicitly advertises destructive capabilities like completing and deleting todos but does not warn users that the skill can modify or permanently remove Taskleef data. In an agentic context, missing disclosure increases the risk of users invoking the skill without understanding it performs write operations, which can lead to unintended data loss or workflow disruption.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill documents direct deletion commands for todos without any warning, confirmation guidance, or safer alternatives. In an agent setting, users may issue ambiguous requests and the agent could choose a destructive action that permanently removes task data, increasing the risk of unintended data loss.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Project deletion is a higher-risk destructive operation because it may remove organizational structures and potentially associated task relationships. Without a warning about data loss or a recommendation to confirm intent, an agent could delete the wrong project based on partial title/ID matching, causing broader accidental disruption.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Clearing a board column is a bulk destructive action that can affect multiple cards at once, making mistakes more damaging than single-item commands. Combined with flexible identifier matching, this increases the chance that an agent or user clears the wrong column and causes significant unintended task loss or workflow disruption.
- Content
Static analysis
No suspicious patterns detected.