← taskgraph-ai@0.63.47
Propose a patch
A fix the maintainer can act on, with the evidence attached. It opens under your GitHub account in your browser; KillerSkills holds no token and never modifies the package. The fix is verified the only way we verify anything: the next crawl re-runs the new version in the honeypot. 70 · Caution
Evidence
The sandbox observed nothing beyond the static findings; the proposal cites those.
Diff · removes 12 caught lines
Download .patchdiff --git a/dist/assets/example_prd.txt b/dist/assets/example_prd.txt
--- a/dist/assets/example_prd.txt
+++ b/dist/assets/example_prd.txt
@@ -1,1 +1,0 @@
-<context>
@@ -16,1 +15,0 @@
-</context>
diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2567,1 +2567,0 @@
-…66ad55eb4d2) Thanks [@Crunchyman-ralph](https://github.com/Crunchyman-ralph)! - Add OpenCode profile with AGENTS.md and MCP config - Resolves #965 ### Patch Changes - [#1009](https://github.c…
@@ -2634,1 +2633,0 @@
-…26001371a87ed56ffc72675d829f3) Thanks [@joedanz](https://github.com/joedanz)! - Add OpenCode profile with AGENTS.md and MCP config - Resolves #965 ### Patch Changes - [#1011](https://github.c…
diff --git a/dist/help-formatters-GiV2ScB1.js b/dist/help-formatters-GiV2ScB1.js
--- a/dist/help-formatters-GiV2ScB1.js
+++ b/dist/help-formatters-GiV2ScB1.js
@@ -19,1 +19,0 @@
-…to ${M(e.aliasFile)}`),e.claudeCode&&t.push(e.mcp?` import TaskGraph’s guide in CLAUDE.md and add the MCP server to .mcp.json`:` import TaskGraph’s guide in CLAUDE.md`),t.join(…
diff --git a/dist/assets/example_prd_rpg.txt b/dist/assets/example_prd_rpg.txt
--- a/dist/assets/example_prd_rpg.txt
+++ b/dist/assets/example_prd_rpg.txt
@@ -15,1 +15,0 @@
-- Follow the instructions in each `<instruction>` block
@@ -36,1 +35,0 @@
-<instruction>
@@ -44,1 +42,0 @@
-</instruction>
@@ -60,1 +57,0 @@
-<instruction>
@@ -101,1 +97,0 @@
-</instruction>
diff --git a/README-upstream.md b/README-upstream.md
--- a/README-upstream.md
+++ b/README-upstream.md
@@ -370,1 +370,0 @@
-taskgraph update --from=<id> --prompt="<prompt>"
@@ -405,1 +404,0 @@
-taskgraph expand --id=<id> --prompt="<context>"
Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of 0.63.47. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.
Issue / PR body
Title: taskgraph-ai: Fake instruction boundary tag (KillerSkills verdict caution 70)
## What the honeypot observed KillerSkills ran **[email protected]** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.8.1) and scored it **CAUTION 70/100**. Summary: no network, touches nothing outside the project, writes no memory. - See the findings below. Full trace and findings: https://killerskills.ai/skills/npm/taskgraph-ai/0.63.47 ## Findings with a location - `dist/assets/example_prd.txt:1` · Fake instruction boundary tag — dist/assets/example_prd.txt:1 · Fake instruction boundary tag · informational: not an instruction file - `CHANGELOG.md:2567` · Instructs the agent to modify its persistent memory or instruction files — CHANGELOG.md:2567 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file - `dist/help-formatters-GiV2ScB1.js:19` · Instructs the agent to modify its persistent memory or instruction files — dist/help-formatters-GiV2ScB1.js:19 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file - `CHANGELOG.md:2634` · Instructs the agent to modify its persistent memory or instruction files — CHANGELOG.md:2634 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file - `dist/assets/example_prd_rpg.txt:60` · Fake instruction boundary tag — dist/assets/example_prd_rpg.txt:60 · Fake instruction boundary tag · informational: not an instruction file - `dist/assets/example_prd.txt:16` · Fake instruction boundary tag — dist/assets/example_prd.txt:16 · Fake instruction boundary tag · informational: not an instruction file - `dist/assets/example_prd_rpg.txt:15` · Fake instruction boundary tag — dist/assets/example_prd_rpg.txt:15 · Fake instruction boundary tag · informational: not an instruction file - `README-upstream.md:370` · Fake instruction boundary tag — README-upstream.md:370 · Fake instruction boundary tag · informational: not an instruction file - `dist/assets/example_prd_rpg.txt:101` · Fake instruction boundary tag — dist/assets/example_prd_rpg.txt:101 · Fake instruction boundary tag · informational: not an instruction file - `dist/assets/example_prd_rpg.txt:44` · Fake instruction boundary tag — dist/assets/example_prd_rpg.txt:44 · Fake instruction boundary tag · informational: not an instruction file - `README-upstream.md:405` · Fake instruction boundary tag — README-upstream.md:405 · Fake instruction boundary tag · informational: not an instruction file - `dist/assets/example_prd_rpg.txt:36` · Fake instruction boundary tag — dist/assets/example_prd_rpg.txt:36 · Fake instruction boundary tag · informational: not an instruction file ## Proposed change The attached patch removes the 12 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account. ## How this will be verified Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page. _Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._
# or from a terminal, under your own account: gh repo fork stephennmiller/taskgraph-ai --clone && cd taskgraph-ai curl -s https://killerskills.ai/skills/npm/taskgraph-ai/0.63.47/patch.diff | git apply --unidiff-zero git checkout -b killerskills/0.63.47 && git commit -am "taskgraph-ai: Fake instruction boundary tag" gh pr create --fill --body-file <(curl -s https://killerskills.ai/skills/npm/taskgraph-ai/0.63.47/patch.md)
We count proposals opened, not merged: a merge shows up as a new version that the crawl re-runs. Disputes: the maintainer can contest the verdict from its page; a person reviews it and the outcome is published.