task-agent — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited task-agent (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill requires Python 3.8+ and standard library only. No external packages needed.
To install this skill's dependencies:
pip-compile ./requirements.in
pip install -r ./requirements.txtSee ./requirements.txt for the dependency lockfile (currently empty — standard library only).
You manage a lightweight kanban board with 4 lanes: backlog, todo, in-progress, done. Tasks are represented as standalone Markdown files (NNNN-title.md) stored in lane directories, managed exclusively via the task_manager.py CLI.
Canonical path (use this — agents run from the root of the current skill folder):
scripts/task_manager.pyThis is the installed copy of the script. Always invoke with an absolute or root-relative path:
python3 ./scripts/task_manager.py <command>Do NOT use ./task_manager.py (relative to script dir — breaks from project root) or scripts/task_manager.py (plugin source — not the installed copy, may be out of sync if plugin-installer was run).
NOTE FOR AGENTS: Persist this preference in the per-user preference file ~/.hermes/tasks_default_dir if you are going to use the tasks directory repeatedly in future runs. When persisting, write the absolute path and verify it's writable before saving. Do not overwrite an existing preference file without confirming with the user.
Examples:
python3 ./scripts/task_manager.py create "Short Title" --lane backlog --dir /Users/richardfremmerlid/Projects/hermes-agent/tasks
export HERMES_TASKS_ROOT=/Users/richardfremmerlid/Projects/hermes-agent/tasks python3 ./scripts/task_manager.py create "Short Title" --lane backlog --dir "$HERMES_TASKS_ROOT"
python3 ./scripts/task_manager.py board and present the returned view to the user so they see the canonical board state.
The kanban board is a strictly managed directory state. Task IDs must be globally unique and sequentially numbered. The python CLI enforces all of this automatically.
AVOID creating, renaming, moving, or deleting task Markdown files using raw native tools (write_to_file, mv, cp, rm) because doing so can bypass the sequential ID generator and risk corrupting the board by creating duplicate numbers or malformed frontmatter.
PREFER task_manager.py as the primary interface for kanban operations. When interacting over gateways (WhatsApp, Telegram, Slack), the agent may need to create or update task files directly to accommodate asynchronous message-driven flows; in those cases the agent should:
scripts/task_manager.py sync --adopt /path/to/file to let the canonical CLI reconcile numbering and register the task properly.scripts/task_manager.py board and report the live board state back to the user.When direct file writes are required, the agent must include a comment in the frontmatter noting the original delivery channel (e.g. WhatsApp) and a small audit trail entry so humans can trace provenance.
NEVER report the current task state from memory. Boards change between tool calls.
ALWAYS run task_manager.py board after any state-change operation to show the user the live, current kanban state.
When executing task_manager.py:
1 stating a task ID does not exist, do not attempt to manually look for the file in the lane directories. Report the ID as not found and ask the user to confirm.references/fallback-tree.md.By default this CLI computes PROJECT_ROOT by walking up from the script location and returning the nearest parent directory that contains a .git folder. That means the effective tasks directory (used when --dir is omitted) is PROJECT_ROOT/tasks and will vary depending on which checkout you invoked the script from.
If a user preference exists for which repository should host kanban tasks, prefer honoring that explicit per-user preference. On this host the user prefers the Hermes Agent project root as the canonical tasks root: /Users/richardfremmerlid/Projects/hermes-agent/tasks.
Practical guidance — follow these rules when creating or manipulating tasks programmatically or as an agent:
--dir overrides. If a caller provides --dir, always use it. Example: python3 ./scripts/task_manager.py --dir /Users/richardfremmerlid/Projects/hermes-agent/tasks create "Title" --lane backlog.--dir is omitted, prefer a user-configured default (see section "Per-user defaults") before falling back to the computed PROJECT_ROOT/tasks.--dir pointed at the target repo so the ID generator and history remain correct.WARNING: computed PROJECT_ROOT is <path>; use --dir to target a different tasks folder.Per-user defaults
~/.hermes/tasks_default_dir containing an absolute path to the desired tasks directory. If present and writable, use that as the default tasks_dir in lieu of the computed PROJECT_ROOT/tasks. This keeps CLI behavior predictable in multi-repo environments.--dir flags.Compatibility and pitfalls
.agents/ trees. If you see unexpected paths, use --dir or set the per-user default.If the runtime terminal wrapper returns errors mentioning foreground/backgrounding (for example: "Foreground command uses '&' backgrounding"), the failure is commonly caused by attempting to run many CLI commands in one foreground shell or using shell backgrounding. Best practices:
python3 ./scripts/task_manager.py <command> as a separate terminal call instead of batching multiple commands with &, ;, or long shell scripts. The agent terminal wrapper enforces a foreground/backgrounding guard that can reject grouped commands.This guidance reduces flakiness when agents drive the CLI from the runtime terminal tool.
Always create the task with a short, descriptive title first to avoid filename length errors.
python ./scripts/task_manager.py create "Short Title" --lane todoAfter creation, update the generated Markdown file to add full details, objectives, and acceptance criteria.
This two-step process ensures filenames remain valid and all task details are captured without error.
When an assistant or automation creates tasks on behalf of a human, prefer creating fully-populated task files (Objective, Acceptance Criteria, Estimate, and Notes) instead of leaving only stubs. Use the provided populated-task template and pass an explicit --dir when the target project differs from the skill's detected PROJECT_ROOT.
Conventions:
python3 ./scripts/task_manager.py --dir /Users/richardfremmerlid/Projects/hermes-agent/tasks create "Short Title" --lane backlog --objective "..." --acceptance "..."These preferences are assistant-facing: humans may still use the two-step create→edit flow, but automated agents should default to producing filled-out tasks so the board is actionable immediately.
python ./scripts/task_manager.py boardpython ./scripts/task_manager.py move 3 in-progress --note "Starting work"python ./scripts/task_manager.py search "login"Tasks are Markdown files stored in lane subdirectories (read-only for the agent, managed exclusively by the CLI):
tasks/backlog/tasks/todo/tasks/in-progress/tasks/done/~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.