ClawHub
Back to skill

Security audit

taskleef

Security checks across malware telemetry and agentic risk

Overview

This skill coherently manages a user's Taskleef todos, projects, and boards, with expected but real risks around account changes, deletion commands, API key use, and a downloaded CLI.

Install only if you want an agent to manage your live Taskleef account. Keep TASKLEEF_API_KEY out of shared files and logs, consider reviewing or pinning the downloaded todo CLI before use, and require explicit confirmation before delete, project delete, board clear, or partial-match operations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill documents destructive todo deletion commands (`todo delete`, `todo rm`) without any caution about permanence, confirmation, or the risk of acting on partial title matches. In this skill, identifiers can be matched by partial title or ID prefix, which increases the chance that a user or agent could delete the wrong item unintentionally.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The project deletion command is presented as routine usage without explaining whether deleting a project also removes associations, tasks, or board organization. Because this skill is intended for task management, omitting data-impact warnings can lead to accidental loss or disruption of a user's work structure.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The board clear operation can affect multiple cards at once, yet the skill provides no warning about scope, reversibility, or safeguards. Bulk-destructive actions are especially risky in an agent context because a single ambiguous instruction could trigger widespread unintended changes.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.