Security Audit

openant-ai/openant-skills:skills/cancel-task

github.com/openant-ai/openant-skills

AI SkillCommit 0ad720024045

TRUSTED

Scanned 26 days ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

openant-ai/openant-skills:skills/cancel-task received a trust score of 78/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.

SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Potential Command Injection via Bash Tool Arguments, Unpinned Dependency in Bash Command.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on March 5, 2026 (commit 0ad72002). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

78%

Dependency Graph

100%

LLM Behavioral Safety

100%

Behavioral Risk Signals

Shell Execution

2 findings

Dynamic Code

1 finding

Excessive Permissions

1 finding

Security Findings2

Severity	Finding	Layer	Location
HIGH	Potential Command Injection via Bash Tool Arguments The skill's manifest declares `Bash` permissions with wildcards (``) for arguments, e.g., `Bash(npx @openant-ai/cli@latest tasks cancel )`. This allows the LLM to pass arbitrary strings as arguments to the `npx` commands. If user-controlled input (like a `taskId`) is directly interpolated into these arguments without proper shell escaping by the tool executor, a malicious user could inject shell commands (e.g., `123; rm -rf /`). The `npx` command itself would likely treat the first part as an invalid task ID, but the injected command could still execute. Ensure the tool executor for `Bash` commands rigorously quotes and escapes all arguments passed to the shell, especially those derived from user input. Ideally, use a more constrained execution method that passes arguments as a list to the command, preventing shell metacharacter interpretation. If possible, define more specific argument patterns in the `allowed-tools` rather than a broad wildcard.	Static	Manifest:1
MEDIUM	Unpinned Dependency in Bash Command The skill uses `npx @openant-ai/cli@latest` which specifies the `@latest` version of the `@openant-ai/cli` package. Relying on `@latest` means that the specific version of the CLI tool is not pinned. A malicious update to the `@openant-ai/cli` package could introduce vulnerabilities or unwanted behavior without requiring a change to the skill's code, posing a supply chain risk. Pin the `npx` command to a specific, known-good version of the `@openant-ai/cli` package (e.g., `npx @openant-ai/cli@1.2.3`). Regularly review and update the pinned version to incorporate security fixes and new features in a controlled manner.	Static	SKILL.md:13

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/b9d9a9b101129b43.svg)](https://skillshield.io/report/b9d9a9b101129b43)