agent-task-takeover@1.2.0
CAUTION· install onlyPublisher claims: "Cross-agent task takeover & handoff skill: read another AI coding agent's session (opencode, ZCode, Codex, Claude Code, Gemini CLI, Cursor, Trae, VS Code Copilot...), reconstruct its task state from transcripts or artifacts, verify on disk, and continue t" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 79/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenariosStatic findings
return subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.* npx agent-task-takeover --where # print the target dir and exitFix: Pin versions and sources; vendor anything fetched at install time.* npx agent-task-takeover # install / refreshFix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
No advisories in OSV for agent-task-takeover@1.2.0 as of 2d ago. This is the package itself, not its dependencies.
What would make this Verified
1 point to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim lawson2019: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
- New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
- Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.