Eisenhower Task Manager

• Outcome: Review
• Latest audit: Jul 13, 2026 · 1:09 PM UTC
• Version: 8.3.4

Overview

The skill is a task manager, but its dashboard also exposes a browser-based shell with no visible authentication, which is powerful enough to run commands on the host.

Install only if you explicitly want this skill to run a local web dashboard that can edit your task files and provide a browser-accessible shell. Do not run the dashboard on shared machines, remote servers, or networks you do not fully trust unless the terminal is removed or protected with strong authentication and localhost-only binding.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (42)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill advertises only task-management behavior, but the documentation explicitly supports environment-variable control and network-facing dashboard/server behavior without declaring corresponding permissions or capabilities. Hidden env/network use weakens user trust and can enable unexpected data exposure or execution paths, especially when combined with a browser-opened dashboard and background service.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This is a substantive description-behavior mismatch: the skill presents itself as a task manager but also describes launching a daemonized web server, opening a browser UI, installing dependencies, watching files, and exposing an interactive terminal. That gap materially increases risk because users may authorize a simple productivity skill without realizing it can create services, expose local interfaces, and provide shell-like access.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: An integrated browser-accessible terminal is unrelated to the core task-management purpose and dramatically expands the attack surface. If enabled, it could permit arbitrary command execution or indirect abuse through the dashboard channel, turning a file-editing productivity skill into a local execution surface.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The lockfile shows the dashboard depends on @xterm/xterm, @xterm/addon-fit, node-pty, express-ws, and ws, which together enable a browser-accessible interactive terminal backed by a server-side pseudo-terminal. For a task-management skill, this capability is unnecessary and materially expands the attack surface to remote command execution if any terminal route is exposed or later wired into the app.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: A node-pty/xterm stack is a strong indicator of interactive shell capability exposed through the web UI. In the context of a task manager, that is highly inappropriate because compromise or misuse would likely grant arbitrary command execution on the host running the skill, making the mismatch between stated functionality and included capability especially dangerous.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The package declares terminal emulation and pseudoterminal dependencies (@xterm/xterm, @xterm/addon-fit, node-pty) that enable interactive shell-style capabilities, which are not justified by a task-management dashboard's stated purpose. In an agent skill context, this substantially expands the attack surface and can facilitate arbitrary command execution or remote shell exposure if wired into the server.

Context-Inappropriate Capability

Low

• Confidence: 71% confidence
• Finding: WebSocket server capability (express-ws and ws) is more powerful than a basic task dashboard obviously requires and can create persistent bidirectional channels that are often used for live control surfaces. In combination with the terminal-related dependencies present in the same package, this becomes more suspicious because WebSockets are a common transport for browser-to-shell bridging.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This file is documented as a markdown parser, but it also exposes many state-changing operations including move, copy, delete, reorder, complete, archive, and blocked-status mutation across several files. That mismatch increases the chance that a caller or reviewer grants it broader trust than warranted, enabling unintended destructive actions on persistent task data.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code writes to an additional archived.md store and moves data there as part of completion flows, which expands persistence and data-retention behavior beyond the apparent parser scope. Hidden archival behavior can surprise users, retain sensitive task/customer data longer than expected, and make data lifecycle harder to reason about or govern.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This frontend initializes an embedded terminal feature even though the skill is described as a task manager, creating a capability mismatch that is highly suspicious. An interactive shell exposed through the dashboard can enable arbitrary command execution or backend session access if the paired server endpoint is reachable, which is far beyond what users would reasonably expect from this skill.

Context-Inappropriate Capability

High

• Confidence: 100% confidence
• Finding: The code opens a WebSocket to /terminal and forwards keystrokes from the browser directly to the server while writing server output back into the page, which is effectively a browser-based remote shell. In the context of a task-management skill, this is an unjustified high-risk capability that could allow command execution, data theft, persistence, or full host compromise depending on the backend implementation.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The HTML loads xterm.js and exposes a terminal container and toggle controls even though the skill is described as a task-management dashboard. This creates undisclosed interactive execution capability in a context where users would not reasonably expect shell access, increasing the risk of abuse or operator deception if backed by a command-executing service.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: An embedded terminal is unjustified for task and customer project management and materially expands the attack surface from data display to potential command execution. If connected to a backend shell or agent runtime, an attacker or misled user could use it to inspect files, alter state, access secrets, or run arbitrary system commands.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The server exposes a /terminal WebSocket that creates a persistent PTY-backed shell and relays shell output to connected clients. This is far outside the stated task-management purpose and effectively provides remote command execution on the host running the dashboard, which can lead to full system compromise and data access.

Context-Inappropriate Capability

Critical

• Confidence: 100% confidence
• Finding: node-pty is used to spawn an interactive shell and later the WebSocket message handler writes arbitrary client-supplied data directly into that shell. Any party that can connect can execute arbitrary OS commands with the privileges of the server process, enabling takeover of the host, reading/modifying files, and pivoting to other systems.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This documentation directs the implementing agent to execute local shell commands, background a process, read a local file for a port, and open a browser as part of a task-management workflow. Those side effects exceed the core need of managing tasks and create an unnecessary execution surface; if implemented broadly, they could trigger unintended command execution or browser launch in environments where such actions are unsafe or unexpected.

Intent-Code Divergence

Low

• Confidence: 86% confidence
• Finding: The document claims the workflow is opt-in and user-controlled, but then recommends a configuration that suppresses the approval prompt and opens the dashboard automatically. This inconsistency weakens the safety boundary and can normalize surprise side effects, especially in non-interactive or automation contexts.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The README advertises delete, move, complete, and copy operations that directly modify the underlying markdown files, but it does not give a clear warning that these actions have persistent filesystem effects. In a dashboard with real-time sync and integrated terminal usage, users may assume actions are easily reversible, increasing the risk of unintended data loss or corruption of task records.

Missing User Warnings

Low

• Confidence: 71% confidence
• Finding: The skill instructs deletion, movement, renumbering, and archival of task data without an explicit warning that it will modify source markdown files. In a task-management context this is expected behavior, but lacking clear confirmation and backup guidance increases the chance of accidental data loss or unintended bulk edits.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Functions such as move/delete/write paths perform direct fs.writeFileSync mutations to task files without any in-function confirmation, dry-run mode, or safety interlock. If invoked by an agent or UI action with mistaken parameters, the skill can silently overwrite or remove user task data.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Archive/complete flows rewrite multiple files in sequence, such as removing entries from one file and appending to archived.md, without explicit disclosure or transactional protection. A bad call, partial failure, or deceptive trigger can cause irreversible data movement, duplication, or loss across task and archive stores.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The terminal session is initialized and connected without any explicit user-facing warning, confirmation, or security context despite exposing remote interactive access. That increases the likelihood of unsuspecting users opening a privileged session and reduces informed consent around a dangerous capability that should not exist in this skill context.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The UI presents a terminal toggle button with no visible notice that interacting with it may execute commands or affect the system. This omission increases the chance of unsafe use, social engineering, and accidental invocation of powerful functionality under the guise of a normal dashboard feature.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The terminal capability is not just insufficiently disclosed; it silently grants an interactive shell to WebSocket clients. In a task dashboard context, users would not reasonably expect shell access, increasing the chance of unsafe exposure or accidental deployment where remote users can abuse it.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The auto-launch option bypasses the explicit user approval gate before opening the dashboard/browser. While the target is localhost, bypassing consent still creates an avoidable side effect that can disrupt user sessions, break scripted workflows, or be abused by downstream implementations to justify broader promptless actions.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.