Claude Task Runner

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:44 AM UTC
• Version: 1.1.0

Overview

The skill is purpose-aligned but should be reviewed because it recommends unattended local shell and file execution with permission checks bypassed and limited guardrails.

Install only if you understand that this can launch headless Claude Code tasks that write files and run Bash locally. Use it in a dedicated trusted workspace, avoid `bypassPermissions` for unreviewed prompts or repositories, and prefer explicit user approval, sandboxing, and artifact/path validation before giving it access to important files or credentials.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:53

Finding

Delegated Shell and Filesystem Access with Permission Checks Disabled

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Recommending bypass of permission checks for writing files or running Bash without a safety warning encourages operators to disable a primary safeguard designed to prevent risky autonomous actions. Because this skill is specifically for non-interactive, headless execution, removing approval gates makes misuse and prompt-driven abuse substantially more dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file documents use of a local runner to execute shell commands and includes an example that creates /abs/workdir/output.txt using --permission-mode bypassPermissions. The skill description explains how to perform these actions but does not include a clear warning that the skill may execute commands and modify files on the local system.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly recommends --permission-mode bypassPermissions, which suppresses approval checks for file writes and Bash execution. In a headless runner context, this meaningfully increases the chance that unsafe prompts, prompt injection, or operator mistakes result in unattended destructive actions on the local system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation explicitly recommends --permission-mode bypassPermissions in routine examples without any warning that it suppresses interactive approval for bash/write actions. In a headless task runner, this lowers safety barriers and can normalize unattended execution of filesystem-modifying or destructive actions, increasing the chance of harmful prompts causing unintended changes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/runner-usage.md (reported line 80)May include surrounding context.

md

## Known limitations

- Headless tasks without `--permission-mode bypassPermissions` may stall waiting for user approval on Bash/write commands
- `--expect-contains` must appear **after** its corresponding `--expect-file`; if no file precedes it, validation will fail
- Glob patterns are resolved relative to `workdir` unless absolute
- Sub-process cleanup relies on pid file; if the host restarts, stale pids show as "running" until `kill` or `clean`

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest describes a local headless Claude task runner focused on execution, model switching, JSON/schema checks, and artifact validation. Line L011 adds 'notification on completion/failure' as a capability, which is ancillary operational behavior not reflected in the manifest description and not obviously required for task execution or validation.

Content

No source excerpt is available for this finding.