ai-task-hub — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ai-task-hub (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Formerly skill-hub-gateway.
Public package boundary:
portal.skill.execute, portal.skill.poll, and portal.skill.presentation.api_key or userToken inside this package.Chinese documentation: SKILL.zh-CN.md
Use this skill when the user asks to:
speech to text, audio transcription)text to speech, voice generation)document to markdown)poll, check job status)overlay, mask, and cutoutExample requests that should trigger this skill:
vision aliases: face detection, human detection, person detection, image taggingbackground aliases: remove background, background removal, cutout, matting, product-cutoutasr aliases: speech to text, audio transcription, transcribe audiotts aliases: text to speech, voice generation, speech synthesismarkdown_convert aliases: document to markdown, file to markdown, markdown conversionpoll aliases: check job status, poll long-running task, async run statuspresentation aliases: rendered output, overlay, mask, cutout filesembeddings/reranker aliases: vectorization, semantic vectors, relevance rerankingDefault API base URL: https://gateway-api.binaryworks.app
Action to endpoint mapping:
portal.skill.execute -> POST /agent/skill/executeportal.skill.poll -> GET /agent/skill/runs/:run_idportal.skill.presentation -> GET /agent/skill/runs/:run_id/presentationEvery request must include:
X-Agent-Task-Token: <jwt_or_paseto>Recommended token claims:
sub (user_id)agent_uidconversation_idscope (execute|poll|presentation)expjtiCLI argument order for scripts/skill.mjs:
[agent_task_token] <action> <payload_json> [base_url]AGENT_TASK_TOKEN from environment.AGENT_TASK_TOKEN automatically to avoid user-facing auth friction.portal.skill.execute: payload requires capability and input.payload.request_id is optional and passed through.portal.skill.poll and portal.skill.presentation: payload requires run_id.portal.skill.presentation supports include_files (defaults to true).Attachment normalization:
image_url / audio_url / file_url.attachment.url is mapped to target media field by capability.file_path is disabled in the published package./api/blob/upload-file.request_id, data, error.POINTS_INSUFFICIENT and pass through error.details.recharge_url.scripts/skill.mjsscripts/agent-task-auth.mjsscripts/base-url.mjsscripts/attachment-normalize.mjsscripts/telemetry.mjs (compatibility shim)references/capabilities.jsonreferences/openapi.jsonSKILL.zh-CN.md~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.