Skills/Glama/ai-task-tracking

ai-task-tracking@0.1.0

CAUTION· startup only

Publisher claims: "Enables AI coding agents to file and track issues, plan epics with steps, comment as they work, and hand decisions back to the user through a local Markdown- and YAML-backed issue tracker." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher altoption · publishing for 3 daysInstalls 0Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
ANTHROPIC_API_KEYConfiguration, not credentials: AITT_APP_DIR, AITT_HOME, AITT_TEST_APP_SEARCH_DIRS, CODEX_HOME, DIR, FILE_KEYS, HOME_DIR, HOTKEY_SWIFT, SEED_ID, SHOTS_CLOCK
Where it talks to
no vendor host named in the codeAlso bun.sh, githubusercontent.com, chatgpt.com, cursor.com, visualstudio.com, windsurf.com, geminicli.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names bun.sh, githubusercontent.com, chatgpt.com, cursor.com, visualstudio.com, windsurf.com, geminicli.com as well as its own vendor. The guard injects ANTHROPIC_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-11 and scored it 62/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Destructive file system command detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 29 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessexec /usr/bin/dirname
0.0sprocessexec /usr/bin/cat
0.0sprocessexec /usr/bin/mkdir
0.0sprocessexited 127: /tmp/ks-detonate-gsKAUF/setup/home/work/acme-api/.claude/skills/ai-task-tracking/scripts/lib.sh: line 114: bun: command not found
8.9sprocessdependency install exit 0
29sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-gsKAUF/task/home/work/acme-api/.claude/skills/ai-task-tracking/src/engine/git' } Node.js v22.23.4
29sprocessscript backend runs setup only
29sprocesssecond launch, clock +45 days, CI unset
29sprocessexec /usr/bin/dirname
29sprocessexec /usr/bin/cat
29sprocessexec /usr/bin/mkdir
29sprocessexited 127: /tmp/ks-detonate-gsKAUF/later/home/work/acme-api/.claude/skills/ai-task-tracking/scripts/lib.sh: line 114: bun: command not found

Static findings

HIGH
Access to sensitive file pathssrc/setup/clients.ts:304 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileselse lines.splice(lastKey(main) + 1, 0, '', `[mcp_servers.${SERVER}.env]`, `AITT_HOME = ${home}`)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/setup/clients.ts:245 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files`[mcp_servers.${SERVER}]\ncommand = ${JSON.stringify(t.binary)}\nargs = ["mcp"]\n\n[mcp_servers.${SERVER}.env]\nAITT_HOME = ${JSON.stringify(t.home)}\n`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedsrc/setup/clients.ts:45 · Destructive file system command detectedformat: FormatFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
HTML comment carrying imperative instructions to the agentsite/src/content/docs/reference/config.md:8 · HTML comment carrying imperative instructions to the agentGenerated by scripts/gen-docs-reference.ts. Do not edit by hand; run `bun run docs:gen`.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Direct script execution from GitHub raw URLscripts/release.sh:142 · Direct script execution from GitHub raw URL — unverified code source--notes "Install or upgrade: curl -fsSL https://raw.githubusercontent.com/$AITT_REPO/HEAD/install.sh | bash"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
CRITICAL
Pipe-to-shell patternscripts/release.sh:142 · Pipe-to-shell pattern — downloads and immediately executes remote code--notes "Install or upgrade: curl -fsSL https://raw.githubusercontent.com/$AITT_REPO/HEAD/install.sh | bash"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file pathssrc/setup/clients.ts:261 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** The line of our table (`''`) or subtable (`'.env'`). */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/setup/clients.ts:293 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst sub = table('.env')Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Direct script execution from GitHub raw URLskills/ai-task-tracking/SKILL.md:92 · Direct script execution from GitHub raw URL — unverified code sourcecurl -fsSL https://raw.githubusercontent.com/altoption/ai-task-tracking/HEAD/install.sh | bashFix: Pin versions and sources; vendor anything fetched at install time.
AST06
CRITICAL
HTML comment carrying imperative instructions to the agentsite/src/content/docs/reference/cli.md:8 · HTML comment carrying imperative instructions to the agentGenerated by scripts/gen-docs-reference.ts. Do not edit by hand; run `bun run docs:gen`.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Pipe-to-shell patternskills/ai-task-tracking/SKILL.md:92 · Pipe-to-shell pattern — downloads and immediately executes remote codecurl -fsSL https://raw.githubusercontent.com/altoption/ai-task-tracking/HEAD/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Direct script execution from GitHub raw URLtests/scripts/install.test.ts:30 · Direct script execution from GitHub raw URL — unverified code sourcehttps://raw.githubusercontent.com/altoption/ai-task-tracking/*/scripts/lib.sh) emit < "$STUB_LIB" ;;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandscripts/agent-eval.sh:65 · Process kill command — agent can terminate processeskill "$ENGINE_PID" 2>/dev/null || true; wait "$ENGINE_PID" 2>/dev/null || trueFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Access to sensitive file pathstests/scripts/lib.test.ts:35 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst p = Bun.spawnSync(['bash', '-c', `set -euo pipefail; source ${JSON.stringify(LIB)}; ${script}`], { env: { ...env, ...extra } })Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandscripts/agent-eval.sh:41 · Process kill command — agent can terminate processesif [ -n "$ENGINE_PID" ]; then kill "$ENGINE_PID" 2>/dev/null || true; wait "$ENGINE_PID" 2>/dev/null || true; fiFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
File permission modification commandtests/scripts/install.test.ts:243 · File permission modification command — agent changes file ownership/permissions[ -z "$MV_READONLY" ] || chmod a-w "$(dirname "$MV_APP")"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/setup/clients.ts:96 · MCP server using network transport (SSE/HTTP) — data sent over networkfile: 'claude_desktop_config.json', format: 'mcpServers', docs: 'https://modelcontextprotocol.io/docs/develop/connect-local-servers',Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Direct script execution from GitHub raw URLtests/scripts/install.test.ts:94 · Direct script execution from GitHub raw URL — unverified code sourceexpect((await sb.calls()).some((c) => c.includes('https://raw.githubusercontent.com/altoption/ai-task-tracking/HEAD/scripts/lib.sh'))).toBe(true)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandscripts/dev-setup.sh:55 · File permission modification command — agent changes file ownership/permissionschmod +x "$HOOK"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandsrc/store/atomic.ts:15 · Process kill command — agent can terminate processes* Remove atomicWrite temp files left in `dir` by a crash (kill -9 between write and rename).Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Direct script execution from GitHub raw URLtests/scripts/install.test.ts:139 · Direct script execution from GitHub raw URL — unverified code sourceexpect((await sb.calls()).some((c) => c.includes('https://raw.githubusercontent.com/altoption/ai-task-tracking/v0.2.0/scripts/lib.sh'))).toBe(true)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandtests/scripts/install.test.ts:221 · Process kill command — agent can terminate processescase "$*" in *previous.app) ;; *) if [ -n "$RM_SIGNAL" ]; then kill -"$RM_SIGNAL" "$PPID"; sleep 0.2; fi ;; esac ;;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellscripts/release.sh:142 · Remote installer piped to shell--notes "Install or upgrade: curl -fsSL https://raw.githubusercontent.com/$AITT_REPO/HEAD/install.sh | bash"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File permission modification commandtests/scripts/release.test.ts:115 · File permission modification command — agent changes file ownership/permissionsprev=""; for a in "$@"; do [ "$prev" = "--outfile" ] && { printf 'engine' > "$a"; chmod +x "$a"; }; prev="$a"; doneFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandtests/scripts/install.test.ts:572 · File permission modification command — agent changes file ownership/permissionschmod +x "$dest/AI Task Tracking.app/Contents/Resources/aitt"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandtests/scripts/args.test.ts:79 · File permission modification command — agent changes file ownership/permissionsif [ "$1 $2" = "run build" ]; then mkdir -p dist; printf '#!/bin/bash\\nexec %q %q "$@"\\n' "$REAL_BUN" "$REAL_CLI" > dist/aitt; chmod +x dist/aitt; fiFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandtests/scripts/install.test.ts:665 · Process kill command — agent can terminate processesdescribe('install.sh after a kill between the renames', () => {Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandtests/scripts/install.test.ts:187 · Process kill command — agent can terminate processesif [ -n "$OSA_SIGNAL" ]; then kill -"$OSA_SIGNAL" "$PPID"; sleep 0.2; fiFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/setup/clients.ts:77 · MCP server using network transport (SSE/HTTP) — data sent over networkfile: 'mcp.json', format: 'mcpServers', stdioType: true, docs: 'https://cursor.com/docs/context/mcp',Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File permission modification commandtests/scripts/install.test.ts:206 · File permission modification command — agent changes file ownership/permissions[ -z "$STRAND_READONLY" ] || chmod a-w "$(dirname "$STRAND_TO")"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Access to sensitive file pathstests/scripts/install.test.ts:56 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst p = Bun.spawn([...setsid, ...cmd], { env: { ...env, ...extra }, cwd: base, stdin: stdin ? new Blob([stdin]) : 'ignore', stdout: 'pipe', stderr: 'pipe' })Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/setup/clients.ts:92 · MCP server using network transport (SSE/HTTP) — data sent over networkfile: 'settings.json', format: 'mcpServers', guidance: 'GEMINI.md', docs: 'https://geminicli.com/docs/tools/mcp-server/',Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Process kill commandtests/scripts/install.test.ts:244 · Process kill command — agent can terminate processeskill -"$MV_SIGNAL" "$PPID"; sleep 0.2; exit 1Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandtests/scripts/install.test.ts:186 · Process kill command — agent can terminate processescase "$(ps -o comm= -p "$5")" in "$6/Contents/MacOS/"*) kill "$5" ;; esacFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellskills/ai-task-tracking/SKILL.md:92 · Remote installer piped to shellcurl -fsSL https://raw.githubusercontent.com/altoption/ai-task-tracking/HEAD/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Process kill commandscripts/agent-eval.sh:61 · Process kill command — agent can terminate processeskill -0 "$ENGINE_PID" 2>/dev/null || breakFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/setup/clients.ts:87 · MCP server using network transport (SSE/HTTP) — data sent over networkfile: 'mcp_config.json', format: 'mcpServers', docs: 'https://docs.windsurf.com/windsurf/cascade/mcp',Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Process kill commandtests/scripts/lib.test.ts:30 · Process kill command — agent can terminate processescase "$(ps -o comm= -p "$5")" in "$6/Contents/MacOS/"*) kill "$5" ;; esacFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/scripts/install.test.ts:303 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files{ env: { ...env, ...extra }, cwd: base, stdin: 'ignore', stdout: 'pipe', stderr: 'pipe', timeout: o.timeout ?? 50_000 })Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filessite/src/content/docs/reference/cli.md:75 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file| `--claude-md` | add the AI Task Tracking line to ~/.claude/CLAUDE.md; --no-claude-md to skip |Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filessite/src/content/docs/reference/cli.md:61 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file--claude-md add the AI Task Tracking line to ~/.claude/CLAUDE.md; --no-claude-md to skipFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filessrc/setup/setup.ts:86 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file--claude-md add the AI Task Tracking line to ~/.claude/CLAUDE.md; --no-claude-md to skipFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filessite/src/content/docs/start/first-run.md:36 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file| `--claude-md` | add the AI Task Tracking line to `~/.claude/CLAUDE.md`; `--no-claude-md` to skip |Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈1,560 tok
1 file · 80 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

18 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Unclaimed publisher≈ +8 on the totalClaim altoption: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. Direct script execution from GitHub raw URL≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim altoptionPropose a patch to the maintainer