
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@task-shepherd/agent
Advanced tools
AI agent service for automated project analysis and task processing with Claude integration.
# No installation needed - always uses latest version
npx @task-shepherd/agent init
npx @task-shepherd/agent start
# Install globally for permanent CLI access
npm install -g @task-shepherd/agent
# Then use directly
task-shepherd-agent init
task-shepherd-agent start
Note: npx is recommended as it ensures you're always using the latest version without managing global installations.
task-shepherd-agent init
This interactive wizard will guide you through:
Before running init, you'll need:
https://your-org.api.taskshepherd.com/graphql)sk-ant-api03-)After initialization, register the projects you want the agent to work on:
# Register current directory as a workspace
task-shepherd-agent workspace register
# Or register a specific directory
task-shepherd-agent workspace register --path /path/to/your/project
# Or scan common development directories automatically
task-shepherd-agent workspace scan-common
# View registered workspaces
task-shepherd-agent workspace list
task-shepherd-agent start
The agent will:
You can also configure the agent using environment variables for single organization deployments:
# Set your Task Shepherd API connection
export TASK_SHEPHERD_API_URL="https://your-org.api.taskshepherd.com/graphql"
export TASK_SHEPHERD_API_KEY="tks_your_api_key_here"
# Set your Claude API key
export CLAUDE_API_KEY="sk-ant-api03-your_claude_key_here"
# Optional: Customize ports
export PORT=8547
export WEB_PORT=8548
⚠️ Note: Environment variables only support single organization mode. For multi-organization support, use the init wizard and config file approach.
The agent supports working with multiple Task Shepherd organizations simultaneously. After initialization:
To add additional organizations:
~/.task-shepherd-agent/config.jsonorganizations array:{
"agentId": "your-agent-id",
"organizations": [
{
"id": "org-1-id",
"name": "Organization 1",
"apiUrl": "https://org1.api.taskshepherd.com/graphql",
"apiKey": "tks_org1_key",
"enabled": true
},
{
"id": "org-2-id",
"name": "Organization 2",
"apiUrl": "https://org2.api.taskshepherd.com/graphql",
"apiKey": "tks_org2_key",
"enabled": true
}
]
}
task-shepherd-agent startThe agent will poll all enabled organizations for work and process tasks from any of them.
# Required: Task Shepherd API
TASK_SHEPHERD_API_URL="https://api.taskshepherd.com/graphql"
TASK_SHEPHERD_API_KEY="tks_your_api_key"
# Required: AI Provider
CLAUDE_API_KEY="sk-ant-api03-your_key"
# Optional: Service Configuration
PORT=8547 # Agent API port
WEB_PORT=8548 # Dashboard port
MAX_CONCURRENT_JOBS=3 # Concurrent processing limit
TOKEN_RATE_LIMIT=10000 # Daily token limit
Register workspaces for the agent to process:
# Register current directory
task-shepherd-agent workspace register
# Register specific directory
task-shepherd-agent workspace register --path /path/to/project
# Scan common development directories
task-shepherd-agent workspace scan-common
# List registered workspaces
task-shepherd-agent workspace list
Note: Replace task-shepherd-agent with npx @task-shepherd/agent if using npx.
task-shepherd-agent init # Initialize agent
task-shepherd-agent start # Start agent service
task-shepherd-agent status # Check agent status
task-shepherd-agent stop # Stop agent service
task-shepherd-agent workspace register # Register workspace
task-shepherd-agent workspace list # List workspaces
task-shepherd-agent workspace sync # Sync with backend
task-shepherd-agent workspace validate # Validate configuration
task-shepherd-agent analysis start --type project_review
task-shepherd-agent analysis status --job <job-id>
task-shepherd-agent analysis list
When running, the agent provides these endpoints:
# Create analysis job
POST http://localhost:8547/api/analysis
{
"project": {
"id": "project-123",
"name": "My Project"
},
"analysisType": "project_review",
"workspacePath": "/path/to/project"
}
# Get job status
GET http://localhost:8547/api/analysis/{jobId}
# List active jobs
GET http://localhost:8547/api/analysis
# Health check
GET http://localhost:8547/api/health
# Usage statistics
GET http://localhost:8547/api/usage/stats
# Rate limits
GET http://localhost:8547/api/usage/rate-limit
Access the web dashboard at http://localhost:8548 for:
Comprehensive analysis including:
Strategic implementation guidance:
Detailed implementation guidance:
The agent automatically detects and supports:
FROM node:18-alpine
RUN npm install -g @task-shepherd/agent
EXPOSE 8547 8548
CMD ["task-shepherd-agent", "start"]
# Production settings
NODE_ENV=production
TASK_SHEPHERD_API_URL="https://api.taskshepherd.com/graphql"
CLAUDE_API_KEY="your-production-key"
MAX_CONCURRENT_JOBS=5
TOKEN_RATE_LIMIT=50000
# Health check endpoint for load balancers
curl http://localhost:8547/api/health
# Readiness check
curl http://localhost:8547/api/ready
# Test Task Shepherd API connection
curl -H "x-api-key: $TASK_SHEPHERD_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "query { __typename }"}' \
$TASK_SHEPHERD_API_URL
# Check agent status
task-shepherd-agent status
# Validate workspace configuration
task-shepherd-agent workspace validate
# View agent logs
tail -f ~/.task-shepherd-agent/logs/agent.log
Get your API keys from:
Set environment variables or use a .env file:
TASK_SHEPHERD_API_KEY="tks_..."
CLAUDE_API_KEY="sk-ant-api03-..."
Proprietary software - see LICENSE.md for usage terms.
task-shepherd-agent status~/.task-shepherd-agent/logs/FAQs
Simplified AI agent service for Task Shepherd project analysis
The npm package @task-shepherd/agent receives a total of 7 weekly downloads. As such, @task-shepherd/agent popularity was classified as not popular.
We found that @task-shepherd/agent demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.