taskgraph-ai@0.63.47
CAUTION· not startedPublisher claims: "Task management for AI-driven development, built for Claude Code: plan from a PRD, then work tasks one at a time with slash commands, a CLI or an MCP server." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher stephennmiller · publishing for 27 daysInstalls 7,333Last detonated 3d ago
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
CLAUDE_CODE_OAUTH_TOKENConfiguration, not credentials: CLAUDE_CODE_SESSION_ID, CLAUDE_CONFIG_DIR, GIT_ALLOW_PROTOCOL, MCP_MODE, NoDefaultCurrentDirectoryInExePath, PATHEXT, TASKGRAPH_ALLOW_METADATA_UPDATES, TASKGRAPH_DEBUG, TASKGRAPH_HOOK_DIR, TASKGRAPH_LOG_LEVEL, TASKGRAPH_LOOP_CHILD, TASKGRAPH_MCP, TASKGRAPH_NO_COLOR, TASKGRAPH_ORIGINAL_CWD, TASKGRAPH_PARALLEL_WORKER, TASKGRAPH_PROJECT_ROOT, TASKGRAPH_SILENT, TASKGRAPH_TAG, TASKGRAPH_TOOLS, TM_HIDE_BANNER, TM_LOG_LEVEL, TM_PUBLIC_VERSION, TM_SILENT- Where it talks to
- no vendor host named in the codeAlso x.com — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names x.com as well as its own vendor. The guard injects CLAUDE_CODE_OAUTH_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.
$vet-skills run --net declared -- npx -y taskgraph-ai
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-11 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Auto-update or dynamic fetch configuration. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 15 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
15sprocessdependency install exit 1 · npm error 404 Note that you can also install from a npm error 404 tarball, folder, http url, or git url. npm error A complete log of this run can be found in: /tmp/ks-detonate-BxdIO0/task/home/.npm/_logs/2026-11-11T06_42_07_065Z-debug-0.log
15sclaimednot started: dependency install failed (exit 1); the server itself was not observed
15sprocessscript backend runs setup only
15sprocessno install scripts to re-run
Static findings
MEDIUM
File type combined with upload actiondist/src-DpMi_iN2.js:77 · File type combined with upload action — agent may exfiltrate local data files
AST07…super(e||`archive`),this.description(`Move done and cancelled tasks out of tasks.json (restore <id> brings one back)`).option(`--older-than <days>`,`Only tasks last changed at least this many days ago (default: global.archiveAfterDays, els…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagedist/server-DuyefLvA.js:118 · npx invocation of non-well-known package — may execute untrusted code
AST061. Run duplication detection (\`npx jscpd .\`, or similar tool)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actiondist/src-DpMi_iN2.js:75 · File type combined with upload action — agent may exfiltrate local data files
AST07…hSubtasks:!0}),!Mt())):(console.log(S.brand.bold(`${r?` `:``}Tasks:\n`)),console.log(e(ao(t.tasks,{showSubtasks:!0,showDependencies:!0}),jt()&&!Mt())))}setLastResult(e){this.lastResult=e}getLastResult(){return this.lastResult}async cleanup…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagedist/mcp-server.js:3 · npx invocation of non-well-known package — may execute untrusted code
AST06For the CLI, run npx -p taskgraph-ai taskgraph, or install it withFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actiondist/server-DuyefLvA.js:248 · File type combined with upload action — agent may exfiltrate local data files
AST07…lt`,progressFile:r.resolve(this.projectRoot,e.progressFile??`.taskgraph/progress.txt`),sleepSeconds:e.sleepSeconds??5,tag:e.tag,taskId:e.taskId,sandbox:e.sandbox??!1,verbose:e.verbose??!1,maxTurns:e.maxTurns,maxBudgetUsd:e.maxBudgetUsd,mod…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Access to sensitive file pathsdist/server-DuyefLvA.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…`,pe=`.taskgraph/templates/example_prd.txt`,A=`.taskgraph/tasks/tasks.json`,me=`.env.example`,he=`.gitignore`,ge=[`.taskgraph`,k,A],_e=/* @__PURE__ */ `.git,.svn,.h…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagedist/tm-core-d5u-Tjky.js:118 · npx invocation of non-well-known package — may execute untrusted code
AST061. Run duplication detection (\`npx jscpd .\`, or similar tool)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actiondist/tm-core-d5u-Tjky.js:19 · File type combined with upload action — agent may exfiltrate local data files
AST07…i[o].line-1).join(` `).trimEnd()}const fa=e=>n.join(e,`.taskgraph`,`loop-trusted.json`);function pa(e){try{let t=JSON.parse(i.readFileSync(fa(e),`utf8`));return Array.isArray(t)?t:[]}catch{return[]}}function ma(e,t){return e===t||typeof e=…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/src-DpMi_iN2.js:72 · File type combined with upload action — agent may exfiltrate local data files
AST07…g(this.fenceHumanText(a.join(` `)))}displayPlain(e,t){e.tasks.length===0?console.log(this.emptyList(t)):console.log(this.fenceHumanText(Yi(e.tasks,{withSubtasks:t.withSubtasks})))}fenceHumanText(t){return e(t,!Mt())}emptyList(e){return qi(…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/tm-core-d5u-Tjky.js:2 · File type combined with upload action — agent may exfiltrate local data files
AST07…tion hn(e,t){let r=e.getProjectRoot();pn(r),Zt(n.join(r,`.taskgraph/config.local.json`))===Xt&&t?.(`Couldn't read ${A}, using config.json only`);let i=mn(),a=new ln(e,(e,n)=>{e===`warn`&&t?.(n)}),o=e=>{let{provider:t,modelId:n}=a.roleModel…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/tm-core-d5u-Tjky.js:1 · File type combined with upload action — agent may exfiltrate local data files
AST07…/templates`,ce=`.taskgraph/worktrees`,le=`.taskgraph/cache`,k=`.taskgraph/config.json`,A=`.taskgraph/config.local.json`,ue=`.taskgraph/state.json`,de=`.taskgraph/reports/task-complexity-report.json`,fe=`.taskgraph/templates/example_prd.txt…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Access to sensitive file pathsdist/server-DuyefLvA.js:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…(n)&&(t[n]=r);return t}function It(e){let t={};try{t=m(a.readFileSync(r.join(e,`.env`),`utf-8`))}catch(t){t.code!==`ENOENT`&&j(`project-env`).warn(`Could not read $…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Auto-update or dynamic fetch configurationdist/src-DpMi_iN2.js:91 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06…urn`started by a parallel worker`;if(e.explicit)return null;if(n.TASKGRAPH_SKIP_AUTO_UPDATE===`1`)return`TASKGRAPH_SKIP_AUTO_UPDATE=1`;if(n.CI)return`CI environment`;if(n.NODE_ENV===`test`)return`NODE_ENV=test`;if(!r)return`stdin is not a …Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationdist/server-DuyefLvA.js:224 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06…env){let n={...t,[e===`loop`?xn:`TASKGRAPH_PARALLEL_WORKER`]:`1`,TASKGRAPH_SKIP_AUTO_UPDATE:`1`};return delete n[Dt],n}const Rs=[`SIGINT`,`SIGTERM`,`SIGHUP`],zs=5e3,Bs=process.platform!==`win32`;function Vs(e,t,n,r=E){return r(e,t,{...n,de…Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathsdist/tm-core-d5u-Tjky.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…`,fe=`.taskgraph/templates/example_prd.txt`,j=`.taskgraph/tasks/tasks.json`,pe=`.env.example`,me=`.gitignore`,he=[`.taskgraph`,k,j],ge=/* @__PURE__ */ `.git,.svn,.h…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Auto-update or dynamic fetch configurationdist/tm-core-d5u-Tjky.js:2 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06…nst On=`TASKGRAPH_LOOP_CHILD`,kn=`TASKGRAPH_PARALLEL_WORKER`,An=`TASKGRAPH_SKIP_AUTO_UPDATE`,jn=En||`unknown`,Mn=`${Tn||`taskgraph-ai`}@${jn}`,Nn=Dn?.node??``,Pn={pending:{complete:!1,pickable:!0,actionable:!0,finished:!1,active:!0,open:!0…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actiondist/server-DuyefLvA.js:2 · File type combined with upload action — agent may exfiltrate local data files
AST07…tion cn(e,t){let n=e.getProjectRoot();on(n),Wt(r.join(n,`.taskgraph/config.local.json`))===Ut&&t?.(`Couldn't read ${ue}, using config.json only`);let i=sn(),a=new tn(e,(e,n)=>{e===`warn`&&t?.(n)}),o=e=>{let{provider:t,modelId:n}=a.roleMode…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/assets/AGENTS.md:17 · File type combined with upload action — agent may exfiltrate local data files
AST07…3.2`). Change tasks through the commands, not by editing `.taskgraph/tasks/tasks.json`. JSON output (`--json` or `--format json`) starts with a `schemaVersion` (now 3); a higher n…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/src-DpMi_iN2.js:86 · File type combined with upload action — agent may exfiltrate local data files
AST07…(e)}),this.command(`restore`).description(`Move an archived task back into tasks.json`).argument(`<id>`,`ID of the archived task`).option(`-t, --tag <tag>`,`Use a specific tag`).option(`-f, --format <format>`,`Output format (text, json)`,`…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/server-DuyefLvA.js:19 · File type combined with upload action — agent may exfiltrate local data files
AST07…i[o].line-1).join(` `).trimEnd()}const Qi=e=>r.join(e,`.taskgraph`,`loop-trusted.json`);function $i(e){try{let t=JSON.parse(a.readFileSync(Qi(e),`utf8`));return Array.isArray(t)?t:[]}catch{return[]}}function ea(e,t){return e===t||typeof e=…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Access to sensitive file pathsdist/help-formatters-GiV2ScB1.js:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05… and settings from ${e.importFrom}/`),t.push(` create or update .gitignore and .env.example`),e.startGit&&t.push(` start a Git repository`),e.mergeDriver&&t.push(…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actiondist/server-DuyefLvA.js:224 · File type combined with upload action — agent may exfiltrate local data files
AST07…ry{let i=a.realpathSync(e),o=a.realpathSync(r.join(e,`.taskgraph`,`tasks`,`tasks.json`));if(!o.startsWith(i+r.sep))return;let s=a.lstatSync(o);return!s.isFile()||s.size>33554432?void 0:Cs(a.readFileSync(o,`utf8`),t,n)}catch{return}}functio…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Access to sensitive file pathsdist/tm-core-d5u-Tjky.js:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…(n)&&(t[n]=r);return t}function Ut(e){let t={};try{t=m(i.readFileSync(n.join(e,`.env`),`utf-8`))}catch(t){t.code!==`ENOENT`&&M(`project-env`).warn(`Could not read $…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actiondist/server-DuyefLvA.js:1 · File type combined with upload action — agent may exfiltrate local data files
AST07…/templates`,ce=`.taskgraph/worktrees`,le=`.taskgraph/cache`,k=`.taskgraph/config.json`,ue=`.taskgraph/config.local.json`,de=`.taskgraph/state.json`,fe=`.taskgraph/reports/task-complexity-report.json`,pe=`.taskgraph/templates/example_prd.tx…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/src-DpMi_iN2.js:71 · File type combined with upload action — agent may exfiltrate local data files
AST07…?void 0:2},e=>{if(n+=e,n.length<r)return;let t=n.lastIndexOf(` `);t>=0&&(console.log(n.slice(0,t)),n=n.slice(t+1)),r=n.length+So}),console.log(n)}function Co(e){for(let t=0;t<e.length;t++){let n=e[t];if(n===`--`)return!1;if(n===`--json`||[…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File permission modification commandpackage.json:40 · File permission modification command — agent changes file ownership/permissions
AST05"postpack": "chmod +x dist/taskgraph.js dist/mcp-server.js",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.LOW
Fake instruction boundary tagdist/assets/example_prd.txt:1 · Fake instruction boundary tag · informational: not an instruction file
AST01<context>Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Instructs the agent to modify its persistent memory or instruction filesCHANGELOG.md:2567 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01…66ad55eb4d2) Thanks [@Crunchyman-ralph](https://github.com/Crunchyman-ralph)! - Add OpenCode profile with AGENTS.md and MCP config - Resolves #965 ### Patch Changes - [#1009](https://github.c…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
MCP server using network transport (SSE/HTTP)dist/tm-core-d5u-Tjky.js:991 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04…e,`.claude.json`)}function Px(e,t){let r=Cx(Ix(n.join(e,`.mcp.json`)));if(Mx(r?.mcpServers))return{name:`mcp`,status:`pass`,detail:`.mcp.json`};let i=Cx(Ix(t));return Ax(e).map(e=>i?.projects?.[e]?.mcpServers).some(Mx)?{name:`mcp`,status:`…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.LOW
Unpinned dependencydist/src-DpMi_iN2.js:34 · Unpinned dependency
AST06`)}function di(e){return[`The taskgraph CLI is ${v(e.cliVersion)}, but the TaskGraph plugin needs ${v(e.cliRange)}.`,`Ask the user to run: npm install -g taskgraph-ai@latest`].join(`Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.LOW
Unpinned dependencydist/src-DpMi_iN2.js:10 · Unpinned dependency
AST06…ed} or later`]};case`claude`:return{mark:i,value:`not found`,fix:["Install it: `npm install -g @anthropic-ai/claude-code`"]};case`signed-in`:return{mark:i,value:`signed out`,fix:t.checks.some(e=>e.name===`claude`&&e.bundled)?["Install Clau…Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.LOW
Instructs the agent to modify its persistent memory or instruction filesdist/help-formatters-GiV2ScB1.js:19 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01…to ${M(e.aliasFile)}`),e.claudeCode&&t.push(e.mcp?` import TaskGraph’s guide in CLAUDE.md and add the MCP server to .mcp.json`:` import TaskGraph’s guide in CLAUDE.md`),t.join(…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
File type combined with upload actiondist/tm-core-d5u-Tjky.js:248 · File type combined with upload action — agent may exfiltrate local data files
AST07…lt`,progressFile:n.resolve(this.projectRoot,e.progressFile??`.taskgraph/progress.txt`),sleepSeconds:e.sleepSeconds??5,tag:e.tag,taskId:e.taskId,sandbox:e.sandbox??!1,verbose:e.verbose??!1,maxTurns:e.maxTurns,maxBudgetUsd:e.maxBudgetUsd,mod…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.LOW
Instructs the agent to modify its persistent memory or instruction filesCHANGELOG.md:2634 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01…26001371a87ed56ffc72675d829f3) Thanks [@joedanz](https://github.com/joedanz)! - Add OpenCode profile with AGENTS.md and MCP config - Resolves #965 ### Patch Changes - [#1011](https://github.c…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Fake instruction boundary tagdist/assets/example_prd_rpg.txt:60 · Fake instruction boundary tag · informational: not an instruction file
AST01<instruction>Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Fake instruction boundary tagdist/assets/example_prd.txt:16 · Fake instruction boundary tag · informational: not an instruction file
AST01</context>Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Fake instruction boundary tagdist/assets/example_prd_rpg.txt:15 · Fake instruction boundary tag · informational: not an instruction file
AST01- Follow the instructions in each `<instruction>` blockFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Fake instruction boundary tagREADME-upstream.md:370 · Fake instruction boundary tag · informational: not an instruction file
AST01taskgraph update --from=<id> --prompt="<prompt>"Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
File type combined with upload actiondist/tm-core-d5u-Tjky.js:224 · File type combined with upload action — agent may exfiltrate local data files
AST07…ry{let a=i.realpathSync(e),o=i.realpathSync(n.join(e,`.taskgraph`,`tasks`,`tasks.json`));if(!o.startsWith(a+n.sep))return;let s=i.lstatSync(o);return!s.isFile()||s.size>33554432?void 0:zs(i.readFileSync(o,`utf8`),t,r)}catch{return}}functio…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.LOW
Fake instruction boundary tagdist/assets/example_prd_rpg.txt:101 · Fake instruction boundary tag · informational: not an instruction file
AST01</instruction>Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Fake instruction boundary tagdist/assets/example_prd_rpg.txt:44 · Fake instruction boundary tag · informational: not an instruction file
AST01</instruction>Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Fake instruction boundary tagREADME-upstream.md:405 · Fake instruction boundary tag · informational: not an instruction file
AST01taskgraph expand --id=<id> --prompt="<context>"Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Fake instruction boundary tagdist/assets/example_prd_rpg.txt:36 · Fake instruction boundary tag · informational: not an instruction file
AST01<instruction>Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.Cost to the agent
Instructions loaded
≈517 tok
2 files · 18 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for taskgraph-ai@0.63.47 as of 3d ago. This is the package itself, not its dependencies.
What would make this Verified
10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim stephennmiller: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
- Unpinned dependencies≈ +3 on the totalPin exact versions (and ideally hashes) in package.json, requirements or the install script so the bundle cannot change under you.
- File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
- npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim stephennmillerPropose a patch to the maintainer