agent-task-manager
Verdict safe, but 6 findings (3 medium, 3 low), mainly data exfiltration, policy violation, command injection. Most recent scan 2026-02-05.
The agent-task-manager skill is a moderately complex workflow orchestration system with some security concerns but no critical threats. The skill implements stateful task management, rate limiting, and multi-step workflows primarily focused on cryptocurrency monitoring. Key concerns include: (1) hardcoded cryptocurrency addresses that could enable unintended financial surveillance, (2) unbounded autonomous execution loops that run indefinitely without user confirmation, (3) missing metadata documentation, and (4) potentially misleading scope claims. The skill does not exhibit data exfiltration, prompt injection, or malicious code execution patterns. All file operations are local and self-contained within the skill package. The primary risks are related to autonomous behavior and resource consumption rather than malicious intent.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Manages and orchestrates multi-step, stateful agent workflows; handles task dependencies, persistent state, error recovery, and external rate-limiting. Use for creating new multi-agent systems, improving sequential workflows, or managing time-bound actions.
- Package
- 7 files, 15 KB
- SKILL.md
- 259 words, 10 sections
- Code
- Python (4), Shell (1)
SKILL.md covers: Agent Task Manager · Overview · Core Capabilities · 1. **Orchestration and Task State** · 2. **External Rate-Limit Management** · 3. **Modular Role-Based Agents** · Example Workflow: MoltFinance-Auditor · Resources · scripts/ · references/
Findings
MEDIUM User input used in command substitution - potential injection risk Command Injectionstatic
Pattern detected: eval "$
scripts/cooldown.sh:40
if eval "$COMMAND"; thenMEDIUM Hardcoded Cryptocurrency Address in Task Parser Data Exfiltrationllm
The task_parser.py file contains a hardcoded cryptocurrency mint address (7hhAuM18KxYETuDPLR2q3UHK5KKkiQdY1DQNqKGLCpump) for $SHIPYARD token. This hardcoded address in example code could lead to unintended monitoring of specific tokens or be used as a template for unauthorized financial surveillance if users don't modify it.
"target_mint": "7hhAuM18KxYETuDPLR2q3UHK5KKkiQdY1DQNqKGLCpump"MEDIUM Unbounded Automated Execution Loop Resource Abusellm
The skill implements a rate-limited monitoring system that can run indefinitely without user confirmation. The cooldown.sh script combined with the orchestrator creates an autonomous loop that executes financial monitoring and notification tasks every 10 minutes (600 seconds) without requiring ongoing user approval. This could lead to resource exhaustion or unwanted persistent execution.
scripts/task_parser.py
"rate_limit": {"period_seconds": 600, # Check every 10 minutes" combined with cooldown.sh automatic retry logicLOW Skill does not specify a license Policy Violationstatic
Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.
SKILL.md
LOW Missing Optional Metadata Fields Data Exfiltrationllm
The skill manifest is missing optional but recommended fields: license, compatibility, and allowed-tools. While not required, these fields help users understand the skill's requirements and restrictions. The skill performs file I/O operations (reading/writing task_state.json, timestamp files) and executes bash commands, which should be documented in allowed-tools.
SKILL.md
license: Not specified, compatibility: Not specified, allowed-tools: Not specifiedLOW Potentially Misleading Scope Description Social Engineeringllm
The skill description mentions 'creating new multi-agent systems' and 'improving sequential workflows' which could be interpreted as general-purpose orchestration, but the implementation examples are heavily focused on cryptocurrency whale monitoring and financial alerts. The actual use case is more specialized than the broad description suggests.
SKILL.md
Description claims general 'multi-step, stateful agent workflows' but primary example is cryptocurrency monitoring with hardcoded $SHIPYARD tokenWhat is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 2.3 KB |
references/task_schema.md | doc | 2.2 KB |
scripts/cooldown.sh | script | 1.2 KB |
scripts/molt_task.py | script | 2.4 KB |
scripts/orchestrator.py | script | 3.4 KB |
scripts/run_task_from_human.py | script | 1.1 KB |
scripts/task_parser.py | script | 2.1 KB |
Environment variables referenced
TIMESTAMP_DIR
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/agent-task-manager
- Raw scan result: agent-task-manager-scan.json
- Badge for your README:
- Request a re-scan