Task Master

Overview

From the repository's own README, as read at the audited commit.

# ChangesetsThis folder has been automatically generated by `@changesets/cli`, a build tool that works with multi-package repos or single-package repos to help version and publish code. Full documentation is available in the [Changesets repository](https://github.com/changesets/changesets).## What are Changesets?Changesets are a way to track changes to packages in your repository. Each changeset:- Describes the changes you've made- Specifies the type of version bump needed (patch, minor, or major)- Connects these changes with release notes- Automates the versioning and publishing process## How to Use Changesets in Task Master### 2. Making Changes1. Create a new branch for your changes2. Make your code changes3. Write tests and ensure all tests pass### 3. Creating a ChangesetAfter making changes, create a changeset by running:```bashnpx changeset```This will:- Walk you through a CLI to describe your changes- Ask you to select impact level (patch, minor, major)- Create a markdown file in the `.changeset` directory### 4. Impact Level GuidelinesWhen choosing the impact level for your changes:- **Patch**: Bug fixes and minor changes that don't affect how users interact with the system  - Example: Fixing a typo in output text, optimizing code without changing behavior- **Minor**: New features or enhancements that don't break existing functionality  - Example: Adding a new flag to an existing command, adding new task metadata fields- **Major**: Breaking changes that require users to update their usage  - Example: Renaming a command, changing the format of the tasks.json file### 5. Writing Good Changeset DescriptionsYour changeset description should:- Be written for end-users, not developers- Clearly explain what changed and why- Include any migration steps or backward compatibility notes- Reference related issues or pull requests with `#issue-number`Examples:```md# GoodAdded new `--research` flag to the `expand` command that uses Perplexity AIto provide research-backed tas

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude mcp add profiles --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} --env AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} --env AZURE_OPENAI_API_KEY=${AZURE_OPENAI_API_KEY} -- npx -y @tm/profiles

{
  "mcpServers": {
    "profiles": {
      "command": "npx",
      "args": [
        "-y",
        "@tm/profiles"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "AWS_ACCESS_KEY_ID": "${AWS_ACCESS_KEY_ID}",
        "AWS_SECRET_ACCESS_KEY": "${AWS_SECRET_ACCESS_KEY}",
        "AZURE_OPENAI_API_KEY": "${AZURE_OPENAI_API_KEY}"
      }
    }
  }
}

Exposed tools (104) 72 read · 24 write · 8 destructive

Blast radius: 8 tools can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one.

Details

Source

eyaltoledano/claude-task-master

npm

@tm/profiles

Credentials it reads

ANTHROPIC_API_KEYAWS_ACCESS_KEY_IDAWS_SECRET_ACCESS_KEYAZURE_OPENAI_API_KEYCLAUDE_CODE_API_KEYCLAUDE_CODE_OAUTH_TOKENGITHUB_TOKENGOOGLE_API_KEYGOOGLE_APPLICATION_CREDENTIALSGROK_CLI_API_KEYMAX_TOKENSPERPLEXITY_API_KEY

License

NOASSERTION

Stars

28,064 · pushed 137d ago

Trust audit

Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (7 observation(s))

Network

declared (3 observation(s))

Shell

declared (1 observation(s))

Dependencies

not all pinned

Secrets in source

found

Findings (25)

const func = new Function(...Object.keys(context), `return ${condition}`);

- **`dangerouslyBypassApprovalsAndSandbox`** (boolean, optional): Bypass all safety checks (dangerous!)

- Bypass all safety checks including approvals and sandbox

<INSTRUCTION>

<INSTRUCTION>

'<INSTRUCTION>',

taskmaster.mcpb

console.log(chalk.gray(`  Token Type: standard`));

apiKey: 'gemini-cli-no-key-required'

await provider.getClient({ apiKey: 'gemini-cli-no-key-required' });

curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash

autopilot_abort, clear_subtasks, delete_tag, remove-all-subtasks, remove_dependency, remove_subtask, remove_task, rules

.coderabbit.yaml

.cursorignore

.manypkg.json

.mcpbignore

.vscodeignore

exec(`${command} "${filepath}"`);

import { getProjectRoot } from '../../utils/project-root.js';

import { getProjectRoot } from '../../utils/project-root.js';

import { getProjectRoot } from '../../utils/project-root.js';

import { getProjectRoot } from '../../utils/project-root.js';

import { getProjectRoot } from '../../utils/project-root.js';

baseURL: 'http://192.168.1.100:1234/v1'

expect(baseURL).toBe('http://192.168.1.100:1234/v1');

Gates applied: instruction_override, no_behavioural_pass.

Audited 2026-09-13 · audit v0.4.0 · source sha 07049f099312 · full audit: observations/trust-audit/mcp-server/eyaltoledano__task-master.json · Report an issue or request a re-scan

Audit history

Alternatives

Other servers in the same categories, safer ones first.

Questions