Launch Window Planner

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:51 AM UTC
• Version: 19.0.0

Overview

The skill is coherent for launch-window planning, but it instructs persistent launch-state writes that are broader than its lite/read-oriented manifest declares.

Review this before installing if your host relies on the manifest to grant permissions. It should only be used where registry proposals and memory writes are separately authorized, path-scoped, and confirmed by the user before anything persistent is created or promoted.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:42

Finding

Persistent State Writes Exceed the Manifest's Declared Capability Ceiling

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:42-44, 68, 72; distribution-manifest.json:2-6
Vulnerability Type: Capability declaration mismatch permitting persistent state mutations
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:42-44:

markdown

- **Reads**: launch goal, tier, and hard constraints (team availability, store-review submissions, partner/press commitments — User-provided); the stage record in `memory/launch-registry/` when one exists; competitor launch history via `scripts/connectors/producthunt.py`, community rhythm via `scripts/connectors/hn.py`, and news pulse via `scripts/connectors/gdelt.py` (all Measured); the industry event calendar (User-provided). When a connector is unavailable, the user pastes the data instead.
- **Writes**: the window comparison + recommendation to `memory/launch/launch-window-planner/`; the chosen window, buffer, and embargo facts are submitted to `memory/events/launches.ndjson` via an authorized `operation: propose` request to `registry-events.py` for [launch-registry](../../../protocol/launch-registry/SKILL.md) to formalize — this skill never writes `memory/launch-registry/` directly.
- **Promotes**: the recommended window, embargo lift moment, and buffer decisions to `memory/hot-cache.md` and `memory/open-loops.md` (ask before writing); propose the window choice as a pending-decision item — do not write `decisions.md` directly.

SKILL.md:68:

markdown

9. **Submit the decision** — write the recommended window, buffer, and embargo definition to `memory/events/launches.ndjson` via an authorized `operation: propose` request to `registry-events.py` for [launch-registry](../../../protocol/launch-registry/SKILL.md) to formalize.

SKILL.md:72:

markdown

After delivering findings, ask: "Save these results for future sessions?" On confirmation, save to `memory/launch/launch-window-planner/YYYY-MM-DD-<topic>.md` — see [Skill Contract](../..
...[truncated 3472 chars]

Remediation

View remediation

Remediation Suggestions

1. Update distribution-manifest.json to declare narrowly scoped proposal and memory-write capabilities for each required destination. Do not use a broad filesystem-write permission when a registry-specific capability is sufficient.
2. If the lite profile cannot permit state writes, remove persistence instructions from this skill. Return a structured proposal to a separately authorized registry skill instead.
3. Require explicit user confirmation immediately before every persistent operation, including the operation: propose registry submission—not only result saving and optional promotions.
4. Enforce authorization inside registry-events.py. Validate the caller identity, declared package capabilities, operation type, destination, and schema before accepting an event.
5. Restrict registry operations to append-only, schema-validated proposal records. The skill should not be able to approve proposals or modify canonical launch-registry data.
6. Restrict memory writes to approved path prefixes and sanitize topic-derived filenames to prevent path traversal.
7. Add an automated package-validation check that compares behavioral declarations such as Reads, Writes, and Promotes against manifest capabilities and rejects inconsistent packages.
8. Keep the existing prohibition against direct writes to memory/launch-registry/ and verify that this boundary is enforced by host tooling rather than relying only on skill instructions.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The description says to use this skill when the user asks to "pick a launch date" or "plan the launch window," which are natural phrases a user might say in many contexts without clearly intending this specific skill. Although some scope limits are provided later, the activation wording itself does not define a narrow trigger list or clear exclusion boundaries at the point of invocation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

## Save Results

After delivering findings, ask: "Save these results for future sessions?" On confirmation, save to `memory/launch/launch-window-planner/YYYY-MM-DD-<topic>.md` — see [Skill Contract](../../../references/skill-contract.md) §Save Results Template. Window/date/embargo facts go to `memory/events/launches.ndjson` via an authorized `operation: propose` request to `registry-events.py` only — never to `memory/launch-registry/` directly. Do not write memory without asking.

## Reference Materials

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest-facing name and summary include Chinese alongside English, but the file does not state that language presentation is optional or user-selected. This can conflict with a language or locale policy where skills should not impose a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.