Report a security problem through the GitHub security advisory page of this repository. Do not open a public issue for a security problem.
Include this information:
- The version of Tasker.
- The operating system.
- The steps that show the problem.
- The effect of the problem.
The maintainers answer within seven days.
| Version | Support |
|---|---|
| Latest release | Yes |
| Older releases | No |
Tasker limits the attack surface with these measures.
| Measure | Detail |
|---|---|
| Renderer isolation | contextIsolation, sandbox and no node integration. |
| Fixed bridge | The preload script exposes a fixed list of functions. |
| Content security policy | default-src 'self'. The asset scheme serves images and media only. |
| No navigation | The window blocks navigation. External links open in the system browser. |
| Path check | The asset protocol serves files inside the skill folders only. |
| No shell | Tasker starts a program with a list of arguments. No shell reads the string. |
| One child process | The runner holds one child process. The stop key ends it. |
| No network | Tasker makes no network call at run time. |
- A skill folder holds instructions for Claude. Read a skill before you play it.
- The
commandadapter starts the program that you configure. Check the command. - The
desktopadapter sends key events to another application. macOS requires accessibility permission for this action. - A preview file comes from the skill folder. Tasker decodes it in the renderer sandbox.