📦
Audit History
tasknotes - 9 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v9 Latest | Jul 23, 2026, 04:37 AM | 3 confirmed | 0 | No capability change |
| v8 | Jul 7, 2026, 07:53 PM | 5 confirmed | 25 | No capability change |
| v7 | Jul 5, 2026, 01:56 AM | 2 confirmed | 23 | Contains scripts |
| v6 | Jun 28, 2026, 10:23 AM | No confirmed findings | 4 | Contains scriptsExternal commands Filesystem access |
| v5 | Jan 16, 2026, 05:15 PM | No confirmed findings | 0 | No capability change |
| v4 | Jan 16, 2026, 05:15 PM | No confirmed findings | 0 | No capability change |
| v3 | Jan 10, 2026, 10:23 AM | No confirmed findings | 0 | No capability change |
| v2 | Jan 10, 2026, 10:23 AM | No confirmed findings | 0 | No capability change |
| v1 | Jan 10, 2026, 10:23 AM | No confirmed findings | 0 | Baseline |
Audit version 9 Latest
Jul 23, 2026, 04:37 AM
Most static findings are false positives caused by Markdown backticks, placeholders, or intended requests to the local TaskNotes API. Semantic review found unvalidated URL construction, optional authentication, and deletion without confirmation. No prompt injection or malicious exfiltration intent was found.
2
Files scanned
447
Lines analyzed
6
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Unvalidated port value can redirect authenticated requests
TASKNOTES_API_PORT enters the URL authority without numeric validation. A crafted value can change the destination and expose the bearer token.
The port value flows directly into the URL authority, while the API key becomes a bearer header. No validation restricts the port to digits.
Medium
Task mutation API can operate without authentication
The setup permits an empty API token, and the client then omits authorization. Other local processes could modify or delete TaskNotes data.
The documentation explicitly permits an empty token, and the client omits Authorization when absent. This behavior is direct and unambiguous.
Medium
Delete command has no confirmation safeguard
The CLI sends a DELETE request immediately for the supplied task identifier. An agent mistake can cause unintended task loss without confirmation.
The delete command directly issues DELETE after argument parsing. No confirmation flag or prompt exists in the complete CLI implementation.
Risk Factors
🌐 Network access (13)
🔑 Env variables (14)
⚙️ External commands (26)
SKILL.md:18 SKILL.md:19-22 SKILL.md:22-23 SKILL.md:23-27 SKILL.md:27-57 SKILL.md:57-61 SKILL.md:61-62 SKILL.md:62-64 SKILL.md:64-67 SKILL.md:67 SKILL.md:68 SKILL.md:69-70 SKILL.md:70-71 SKILL.md:71-72 SKILL.md:72-73 SKILL.md:73-77 SKILL.md:77-90 SKILL.md:90-91 SKILL.md:91-92 SKILL.md:92-93 SKILL.md:93-94 SKILL.md:94-95 SKILL.md:95-96 SKILL.md:96-97 SKILL.md:97-109 SKILL.md:109-121
Audited by: codex
Jul 7, 2026, 07:53 PM
The skill intentionally runs local CLI commands and uses the TaskNotes localhost HTTP API to read, create, update, and delete Obsidian tasks. No prompt injection or external cloud endpoint was found, but the skill handles an API token, loads a vault-root .env file, and has mutating and destructive task operations.
2
Files scanned
447
Lines analyzed
33
Review items
0
False positives ignored
Confirmed security concerns (5)
High
Environment file access
# Load .env from vault root
The comment describes loading .env from the vault root, and the following code performs that load. A vault-root environment file may contain unrelated secrets.
High
Environment file access
load_dotenv(VAULT_ROOT / ".env")
load_dotenv(VAULT_ROOT / ".env") reads an environment file outside the skill directory. This is sensitive file access in a community skill.
High
Environment file access
3. **Environment variables** in `.env` file at vault root (if using auth):
The documentation instructs users to keep TaskNotes API configuration in a vault-root .env file. This is sensitive configuration guidance, though the actual file read is in scripts/tasks.py.
High
Unvalidated API Port Can Redirect Authenticated Requests
TASKNOTES_API_PORT is inserted into BASE_URL without numeric validation, and TASKNOTES_API_KEY is sent as a bearer header. A crafted port value could change URL parsing and send task data or the token away from localhost.
The code directly interpolates API_PORT into an HTTP URL and sends headers through requests. Exploitation requires malicious environment or config control, so confidence is high but not absolute.
Medium
Destructive Task Deletion Without Confirmation
The CLI exposes a delete command that calls DELETE /tasks/{id} without an in-script confirmation, dry-run, or soft-delete safeguard. A mistaken task path can remove a TaskNotes task from the vault.
The documented delete command maps directly to a DELETE API request in code. No confirmation or recovery safeguard is visible in the cited lines.
Capability review items (25)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
dotenv library
load_dotenv(VAULT_ROOT / ".env")
load_dotenv reads a .env file from the computed vault root. This can load sensitive variables into the process.
High
Python dotenv loader
load_dotenv(VAULT_ROOT / ".env")
The loader reads the vault-root .env file before any command is executed. This is real environment file access, not a placeholder.
High
Generic API/secret keys
API_KEY = os.getenv("TASKNOTES_API_KEY")
No secret is hardcoded, but the code reads TASKNOTES_API_KEY from the environment. A community skill handling API tokens is security-sensitive.
High
Generic API/secret keys
if API_KEY:
The conditional shows API_KEY is used in the request flow when present. This confirms runtime credential handling, although the value is user supplied.
High
Generic API/secret keys
headers["Authorization"] = f"Bearer {API_KEY}"
The API key is placed into an Authorization bearer header for HTTP requests. If the endpoint is misconfigured, the token could be exposed.
Medium
HTTP client library
result = api_request("POST", "/tasks", data=data)
POST /tasks creates TaskNotes entries through the local API. This is an intended but mutating network operation against the user vault.
Medium
HTTP client library
result = api_request("PUT", f"/tasks/{task_id}", data=data)
PUT /tasks/{id} updates existing task records through the local API. This can alter task metadata and body details in the vault.
Medium
HTTP client library
result = api_request("DELETE", f"/tasks/{task_id}")
DELETE /tasks/{id} removes a task through the local API. This is a destructive operation even though it is part of the skill purpose.
Medium
Python getenv function
API_KEY = os.getenv("TASKNOTES_API_KEY")
The script reads TASKNOTES_API_KEY from the environment for API authentication. This is legitimate, but it is real access to sensitive configuration.
Medium
getenv function call
API_KEY = os.getenv("TASKNOTES_API_KEY")
os.getenv reads TASKNOTES_API_KEY, which can contain an authentication token. The value is later used in the Authorization header.
Medium
Ruby/shell backtick execution · 3 occurrences
```bash
The bash block documents uv run scripts/tasks.py commands that agents may execute, including create, update, and delete. The commands are local and purposeful, but external command execution is real.
Low
HTTP client library
def api_request(method: str, endpoint: str, params: dict = None, data: dict = None):
api_request constructs HTTP calls to the TaskNotes API and is used by list, create, update, delete, stats, and options commands. The endpoint is intended for localhost, but this confirms network access to task data.
Low
HTTP client library
response = requests.request(
requests.request sends parameters, JSON bodies, and headers to BASE_URL. The URL is intended for localhost, but the skill performs real HTTP network I/O.
Low
HTTP client library
result = api_request("GET", "/tasks", params=params)
GET /tasks reads TaskNotes task metadata from the local Obsidian API. This is intended behavior, but it confirms task data access over HTTP.
Low
HTTP client library
result = api_request("GET", "/stats")
GET /stats reads aggregate task information from the local API. It is low risk, but it is still network access to user task data.
Low
HTTP client library
result = api_request("GET", "/filter-options")
GET /filter-options reads project, status, and priority metadata from TaskNotes. It is expected local API access, not external exfiltration.
Low
Python HTTP libraries
response = requests.request(
The requests library is used to send actual HTTP requests to BASE_URL. Context shows the calls target the local TaskNotes API.
Low
Hardcoded URL
BASE_URL = f"http://localhost:{API_PORT}/api"
BASE_URL hardcodes an HTTP localhost API endpoint with an environment-supplied port. It is not an external domain, but it confirms local HTTP API use.
Low
Python getenv function
API_PORT = os.getenv("TASKNOTES_API_PORT", "8080")
The script reads TASKNOTES_API_PORT from the environment and uses it to construct the API URL. This is configuration access that influences the network target.
Low
getenv function call
API_PORT = os.getenv("TASKNOTES_API_PORT", "8080")
os.getenv reads TASKNOTES_API_PORT and feeds endpoint construction. The value is not a secret, but it controls connection behavior.
Low
dotenv library
from dotenv import load_dotenv
The dotenv import enables the load_dotenv call later in the file. By itself it is not dangerous, but context confirms environment-file support.
Low
Python dotenv loader
from dotenv import load_dotenv
The python-dotenv import is part of an actual dotenv loading flow at line 35. It confirms environment-file handling in the skill.
Low
Hardcoded URL
Base URL: `http://localhost:8080/api`
The skill documents http://localhost:8080/api as its base endpoint. It is local rather than external, but it confirms dependence on a plaintext local HTTP API.
Risk Factors
🌐 Network access (13)
🔑 Env variables (14)
⚙️ External commands (26)
SKILL.md:18 SKILL.md:19-22 SKILL.md:22-23 SKILL.md:23-27 SKILL.md:27-57 SKILL.md:57-61 SKILL.md:61-62 SKILL.md:62-64 SKILL.md:64-67 SKILL.md:67 SKILL.md:68 SKILL.md:69-70 SKILL.md:70-71 SKILL.md:71-72 SKILL.md:72-73 SKILL.md:73-77 SKILL.md:77-90 SKILL.md:90-91 SKILL.md:91-92 SKILL.md:92-93 SKILL.md:93-94 SKILL.md:94-95 SKILL.md:95-96 SKILL.md:96-97 SKILL.md:97-109 SKILL.md:109-121
Audited by: codex
Jul 5, 2026, 01:56 AM
The skill is a legitimate Obsidian TaskNotes CLI, but it has real security surface: it loads a vault-root .env, reads API credentials, and sends HTTP requests to a local API that can create, update, and delete tasks. Most markdown backtick detections are false positives, and no prompt injection text was found. The main unresolved risk is unvalidated TASKNOTES_API_PORT, which can affect the parsed request host when an Authorization header is present.
2
Files scanned
447
Lines analyzed
28
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Environment file access
load_dotenv(VAULT_ROOT / ".env")
The code explicitly loads a vault-root .env file. This is real sensitive-file access even though the intended use is TaskNotes configuration.
High
Unvalidated Local API Port Can Change Request Host
TASKNOTES_API_PORT is inserted into the URL without numeric validation. A crafted port value can change the parsed host and send the Authorization header away from localhost.
The code builds BASE_URL with an unvalidated environment value and passes headers containing the API key to requests.request. URL userinfo parsing makes host confusion possible if the port value is crafted.
Capability review items (23)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
dotenv library
load_dotenv(VAULT_ROOT / ".env")
The script loads a .env file from the vault root before making API requests. This is intended configuration, but it broadens access to local secret material.
High
Python dotenv loader
load_dotenv(VAULT_ROOT / ".env")
The script loads a .env file from the vault root before making API requests. This is intended configuration, but it broadens access to local secret material.
High
Generic API/secret keys
API_KEY = os.getenv("TASKNOTES_API_KEY")
The script reads TASKNOTES_API_KEY from the environment. This is a legitimate local auth token, but it is still sensitive credential access.
High
Generic API/secret keys
if API_KEY:
The conditional controls whether the configured API key is sent in request headers. It is part of a real credential handling path.
High
Generic API/secret keys
headers["Authorization"] = f"Bearer {API_KEY}"
The script places TASKNOTES_API_KEY into an Authorization bearer header. This is intended auth behavior, but it creates a credential transmission path.
Medium
Ruby/shell backtick execution · 3 occurrences
```bash
The markdown section contains bash examples that run uv with scripts/tasks.py. The command is expected, but it still instructs external command execution.
Low
HTTP client library
def api_request(method: str, endpoint: str, params: dict = None, data: dict = None):
The script performs HTTP requests against the local TaskNotes API. The target is documented as localhost, but the network capability is real.
Low
HTTP client library
response = requests.request(
The script performs HTTP requests against the local TaskNotes API. The target is documented as localhost, but the network capability is real.
Low
HTTP client library
result = api_request("GET", "/tasks", params=params)
The script performs HTTP requests against the local TaskNotes API. The target is documented as localhost, but the network capability is real.
Low
HTTP client library
result = api_request("POST", "/tasks", data=data)
The script sends mutating requests to the local TaskNotes API. This is intended behavior, but it can change local task records.
Low
HTTP client library
result = api_request("PUT", f"/tasks/{task_id}", data=data)
The script sends mutating requests to the local TaskNotes API. This is intended behavior, but it can change local task records.
Low
HTTP client library
result = api_request("DELETE", f"/tasks/{task_id}")
The script sends a DELETE request to the local TaskNotes API. This is intended behavior, but it can remove local task records.
Low
HTTP client library
result = api_request("GET", "/stats")
The script performs HTTP requests against the local TaskNotes API. The target is documented as localhost, but the network capability is real.
Low
HTTP client library
result = api_request("GET", "/filter-options")
The script performs HTTP requests against the local TaskNotes API. The target is documented as localhost, but the network capability is real.
Low
Python HTTP libraries
response = requests.request(
The script performs HTTP requests against the local TaskNotes API. The target is documented as localhost, but the network capability is real.
Low
Hardcoded URL
BASE_URL = f"http://localhost:{API_PORT}/api"
The code builds a local HTTP API base URL for TaskNotes. The localhost target is documented, but it is still real network behavior.
Low
Python getenv function
API_KEY = os.getenv("TASKNOTES_API_KEY")
The script reads TASKNOTES_API_KEY from the environment for TaskNotes authentication. This is expected, but it is still credential access.
Low
Python getenv function
API_PORT = os.getenv("TASKNOTES_API_PORT", "8080")
The script reads TASKNOTES_API_PORT from the environment to configure the local API endpoint. This is legitimate configuration access but affects request construction.
Low
getenv function call
API_KEY = os.getenv("TASKNOTES_API_KEY")
The script reads TASKNOTES_API_KEY from the environment for TaskNotes authentication. This is expected, but it is still credential access.
Low
getenv function call
API_PORT = os.getenv("TASKNOTES_API_PORT", "8080")
The script reads TASKNOTES_API_PORT from the environment to configure the local API endpoint. This is legitimate configuration access but affects request construction.
Low
Hardcoded URL
Base URL: `http://localhost:8080/api`
The documentation discloses a localhost TaskNotes API endpoint. This is expected for the skill, but it confirms the network dependency.
Risk Factors
🌐 Network access (13)
🔑 Env variables (14)
⚙️ External commands (26)
SKILL.md:18 SKILL.md:19-22 SKILL.md:22-23 SKILL.md:23-27 SKILL.md:27-57 SKILL.md:57-61 SKILL.md:61-62 SKILL.md:62-64 SKILL.md:64-67 SKILL.md:67 SKILL.md:68 SKILL.md:69-70 SKILL.md:70-71 SKILL.md:71-72 SKILL.md:72-73 SKILL.md:73-77 SKILL.md:77-90 SKILL.md:90-91 SKILL.md:91-92 SKILL.md:92-93 SKILL.md:93-94 SKILL.md:94-95 SKILL.md:95-96 SKILL.md:96-97 SKILL.md:97-109 SKILL.md:109-121
Audited by: codex
Jun 28, 2026, 10:23 AM
Static analysis found network access, environment variable access, documented shell commands, and several weak-crypto heuristics. Review confirms the skill uses a local TaskNotes HTTP API and optional bearer token, while the weak-crypto and prompt-injection signals are false positives. Publication is acceptable with a warning because API credentials are read from .env and sent over plain HTTP to the configured local endpoint.
2
Files scanned
447
Lines analyzed
8
Review items
1
False positives ignored
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Optional API Token Sent Over Plain HTTP
The script loads TASKNOTES_API_KEY from a vault .env file and adds it as a bearer token for requests to the TaskNotes API. The target is intended to be localhost, but plain HTTP and an unvalidated port configuration make credential exposure possible if local configuration is changed or traffic is intercepted on the host.
The code clearly reads an API token and sends it in an Authorization header on HTTP requests. The intended localhost use lowers confidence of malicious intent, but the credential-handling risk is real.
Medium
Task Data Sent To Local HTTP API
Task titles, details, project names, dates, contexts, and task identifiers are transmitted to the TaskNotes HTTP API. This is core functionality, but it can expose private task content to any process serving the configured local endpoint.
The request payload is built directly from user task fields and sent through api_request. This matches the skill purpose, but it carries sensitive personal task data.
Low
Documented Shell Commands Are Expected Usage
SKILL.md contains uv run examples for invoking the bundled CLI. These are documentation examples rather than dynamic shell execution in code, so command execution findings are mostly false positives.
The flagged lines are fenced command examples in documentation. They do execute the local script when followed, but no dynamic command construction is present there.
Low
Reconnaissance Heuristics Are URL Encoding And Task Queries
Static reconnaissance matches point to URL encoding of task identifiers and normal TaskNotes list or options commands. No evidence found of host, network, or system discovery behavior.
The cited code quotes a task path for a URL and calls documented TaskNotes endpoints. The behavior is scoped to task management, not reconnaissance.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Weak Cryptography Heuristics Are False Positives
Static weak-cryptography matches refer to markdown syntax, date examples, or argparse help text rather than cryptographic functions. No evidence found of MD5, SHA1, DES, RC4, or similar weak algorithms being used.
Manual review of the cited lines found task descriptions, markdown API documentation, and command-line argument definitions. There is no cryptographic operation at those locations.
Risk Factors
⚡ Contains scripts (1)
🌐 Network access (9)
🔑 Env variables (3)
⚙️ External commands (2)
Detected Patterns
Environment-Derived HTTP Endpoint And Authorization Header
Audited by: codex
Jan 16, 2026, 05:15 PM
Standard task management tool with minimal risk. All 89 static findings are false positives. Network calls go exclusively to localhost (Obsidian TaskNotes API), not external endpoints. Environment variables are for local configuration only. No dangerous patterns, data exfiltration, or credential exfiltration detected.
3
Files scanned
672
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
🌐 Network access (1)
📁 Filesystem access (1)
🔑 Env variables (1)
Audited by: claude
Jan 16, 2026, 05:15 PM
Standard task management tool with minimal risk. All 89 static findings are false positives. Network calls go exclusively to localhost (Obsidian TaskNotes API), not external endpoints. Environment variables are for local configuration only. No dangerous patterns, data exfiltration, or credential exfiltration detected.
3
Files scanned
672
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
🌐 Network access (1)
📁 Filesystem access (1)
🔑 Env variables (1)
Audited by: claude
Jan 10, 2026, 10:23 AM
Standard task management tool with minimal risk. Only communicates with local Obsidian API on localhost. Reads specific environment variables for configuration. No dangerous patterns or data exfiltration capabilities detected.
2
Files scanned
400
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
🌐 Network access (1)
📁 Filesystem access (1)
🔑 Env variables (1)
Audited by: claude
Jan 10, 2026, 10:23 AM
Standard task management tool with minimal risk. Only communicates with local Obsidian API on localhost. Reads specific environment variables for configuration. No dangerous patterns or data exfiltration capabilities detected.
2
Files scanned
400
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
🌐 Network access (1)
📁 Filesystem access (1)
🔑 Env variables (1)
Audited by: claude
Jan 10, 2026, 10:23 AM
Standard task management tool with minimal risk. Only communicates with local Obsidian API on localhost. Reads specific environment variables for configuration. No dangerous patterns or data exfiltration capabilities detected.
2
Files scanned
400
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
🌐 Network access (1)
📁 Filesystem access (1)
🔑 Env variables (1)
Audited by: claude