{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-13","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Work with taskPilot boards and items from Claude. Search tasks, create items, update field values and add comments. The described connector has no destructive operations.","did":"02b3013c-281e-4495-aeb7-29cdd779561b","documentation_url":"https://taskpilot.nocodeminute.com/help/ai","editorial_description":{"extended_description":"taskPilot is a workspace for boards, custom tables and item conversations. The connector can list boards, items and comments, and retrieve individual records. Access is authorized for each user through OAuth and can be revoked from taskPilot's integration settings.","schema_version":1,"summary":"Work with taskPilot boards and items from Claude.\nSearch tasks, create items, update field values and add comments.\nThe described connector has no destructive operations."},"homepage_url":"","icon":"https://taskpilot.nocodeminute.com/brand/taskpilot-fox.png","id":"02b3013c-281e-4495-aeb7-29cdd779561b","installs":0,"last_scanned":"","license":"","long_description":"taskPilot is a workspace for boards, custom tables and item conversations. The connector can list boards, items and comments, and retrieve individual records. Access is authorized for each user through OAuth and can be revoked from taskPilot's integration settings.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The declared add_item_comment tool posts supplied comment text onto an authenticated taskPilot item.","reasoning":"The action communicates externally visible content to workspace collaborators under the connected user's authority.","risk_type":"messaging_as_user","severity":"high","title":"Comments can be posted to workspace items","triggering_tools_or_skills":["add_item_comment"]},{"evidence":"The complete inventory declares item creation and persistent cell updates in taskPilot boards.","reasoning":"These operations alter shared operational records.","risk_type":"data_modification","severity":"medium","title":"Boards can receive created and updated items","triggering_tools_or_skills":["create_item","update_item_cells"]},{"evidence":"Read and search tools return free-form task and comment content authored by workspace members.","reasoning":"Collaborator-authored text is untrusted model input.","risk_type":"prompt_injection_exposure","severity":"low","title":"Shared item and comment text enters context","triggering_tools_or_skills":["get_item","list_item_comments","search_items"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication required for a taskPilot workspace; precise scopes and token persistence are not documented in the packet.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/02b3013c-281e-4495-aeb7-29cdd779561b.json","what_it_proves":"Candidate PR #125 record identity (name \"taskPilot\", publisher, type web_connector) and 9 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/02b3013c-281e-4495-aeb7-29cdd779561b: complete tool_names inventory (9 tools), remote streamable-http endpoint https://taskpilot.nocodeminute.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"The explicit add_item_comment action can publish text to collaborators, which is a high-impact messaging capability.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:02b3013c-281e-4495-aeb7-29cdd779561b","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all nine names. The official documentation lookup did not provide tool schemas, so authorization boundaries and confirmation behavior require runtime verification.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":9,"tools_or_skills_total":9},"name":"taskPilot","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=02b3013c-281e-4495-aeb7-29cdd779561b&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://nocodeminute.com/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"NoCodeMinute LLC","publisher_url":"https://nocodeminute.com/","remote_url":"https://taskpilot.nocodeminute.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: The action communicates externally visible content to workspace collaborators under the connected user's authority.","evidence":"Comments can be posted to workspace items: The declared add_item_comment tool posts supplied comment text onto an authenticated taskPilot item.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Comments can be posted to workspace items","triggering_tools":["add_item_comment"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations alter shared operational records.","evidence":"Boards can receive created and updated items: The complete inventory declares item creation and persistent cell updates in taskPilot boards.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Boards can receive created and updated items","triggering_tools":["create_item","update_item_cells"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"hello@nocodeminute.com","tags":["modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"add_item_comment","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: The action communicates externally visible content to workspace collaborators under the connected user's authority."}},{"description":"","name":"create_item","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations alter shared operational records."}},{"description":"","name":"get_board"},{"description":"","name":"get_item"},{"description":"","name":"list_boards"},{"description":"","name":"list_item_comments"},{"description":"","name":"list_items"},{"description":"","name":"search_items"},{"description":"","name":"update_item_cells","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations alter shared operational records."}}],"tools_count":9,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/02b3013c-281e-4495-aeb7-29cdd779561b","uuid":"c5a735f9-db88-5417-ab31-f9f2b57a87d5","verification_tier":"community","version":""},"query_key":"nocodeminute llc taskpilot","schema_version":1,"status":"match"}