Cline Kanban

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:15 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Cline automation guide, but it normalizes high-impact autonomous coding, network exposure, and deploy workflows without enough safeguards.

Install only if you intentionally want a powerful autonomous coding-agent workflow. Prefer pinned package versions, run it in an isolated repo/worktree or container, avoid `-y` for broad tasks, review diffs before commits or deploys, keep provider and deployment tokens least-privilege, and do not expose Kanban on `0.0.0.0` unless you add strong access controls.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:22

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Remediation

View remediation

``` 2. Document the expected package publisher and official registry source. 3. Verify npm integrity and provenance metadata before installation. 4. Avoid using `npx` to download and execute an unpinned package directly. 5. Use a lockfile and a controlled installation process where practical. 6. Review package lifecycle scripts and disable unnecessary installation scripts. 7. Run the coding agent in a container or sandbox with: - Access limited to the intended repository. - No unrelated secrets in the environment. - Restricted network connectivity. - A non-privileged operating-system account. 8. Establish a controlled upgrade process that reviews new versions before changing the documented pin. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:50

Finding

Autonomous Agent Execution with Blanket Approval

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:427

Finding

Kanban Management Service Exposed on All Network Interfaces Without Documented Access Controls

Content

View full analysis

:3484/`. The Pi's firewall typically allows local network traffic on arbitrary ports. Verified working (Apr 2026): bound to `0.0.0.0:3484`, accessed from remote machine on same network. Task created and completed end-to-end. ``` The same all-interface binding is repeated later: ```bash kanban --host 0.0.0.0 --port 3484 --no-open ``` ### Technical Analysis Binding the Kanban service to `0.0.0.0` makes it listen on every available IPv4 network interface rather than only localhost. The instructions explicitly describe remote access over unencrypted HTTP and rely on the observation that a firewall typically permits local-network traffic. The Skill does not document authentication, authorization, TLS, origin restrictions, reverse-proxy protection, or firewall allowlisting for this exposure. The interface is described as capable of creating and starting tasks that run autonomous agents in project worktrees. Consequently, unintended access to this service could expose project metadata or provide a path to trigger agent activity. The finding is based on the unsafe deployment guidance. The audit does not establish whether a particular Cline release independently implements authentication or other controls; those controls must be verified before remote exposure. ### Attack Path 1. A user starts Kanban with `--host 0.0.0.0 --port 3484`. 2. The service becomes reachable through every host interface allowed by local routing and firewall rules. 3. A device or attacker with network reachability connects to the documented HTTP endpoint. 4. If the service lacks effective authentication and authorization, the attacke ...[truncated 1192 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (18)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 82% confidence

Finding

The skill explicitly identifies the on-disk locations of configuration and secret material, including secrets.json. While documenting storage paths can be legitimate, in an agentic environment this information lowers the barrier for follow-on prompt abuse or opportunistic exfiltration attempts by directing attention to credential-bearing files.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

cline auth -p -k <api_key> -m <model_id>

text

**v2.8.0 quirk:** Even with flags, auth launches a TUI. Run in the background with a long timeout (20-25s) — it writes config before exiting on SIGTERM. Config is saved to `~/.cline/data/globalState.json` and `~/.cline/data/secrets.json`.

## One-Shot Tasks (Headless)

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

• Category: YARA Match
• Confidence: 86% confidence

Finding

The file repeatedly encourages autonomous, non-interactive, backgrounded multi-agent editing with the possibility of silent overwrites and destructive repository recovery commands. In this skill's context, the aggregate pattern is risky because it normalizes unsupervised code and repo mutation workflows without strong safety boundaries, increasing the chance of data loss or propagation of harmful changes.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md

s. The one-agent-per-file constraint does not apply when using Kanban.

## Single-File Rule

**One agent per file, always** — unless using Kanban (worktrees handle isolation natively). If multiple tasks touch the same file and you're using raw CLI, combine them into one agent prompt. Two agents editing the same file concurrently will clobber each other — the second write overwrites the first, silently. Group tasks by file before dispatching.

## Parallel Bug-Fix Pattern (Multi-Agent from Code Review)

When a code review surfaces N independent issues, dispatch one Cline agent per issue
as background processes. **Critical rule: split work so no two agents touch the same file.
If two agents edit the same file concurrently, the second write overwrites the first.**

Workflow:
1. Group issues by the files they require editing
2. Combine any issues that share files into a single agent task
3. Dispatch agents in sequence (small stagger), redirect each to its own log
4. Schedule a cron job

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This section describes a fully autonomous workflow that reviews diffs, commits, pushes, deploys, and uses deployment credentials, yet it lacks explicit guardrails around secret scope, branch protection, environment separation, or approval gates. In practice, that can enable unintended production changes, credential misuse, and automated propagation of buggy or malicious modifications.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 546)May include surrounding context.

md

Set up full-stack app with Express + SQLite. Tasks:
1) Initialize Express with TypeScript, install better-sqlite3
2) Create database module (src/db.ts) with users table (id, name, email, created_at)
3) Add CRUD routes: GET /users, GET /users/:id, POST /users, PUT /users/:id, DELETE /users/:id
4) Add input validation middleware using zod for POST/PUT
5) Add seed script with 10 sample users
Link 1 → 2 → 3 → 4, and 2 → 5 so seeding runs in parallel with routes. Start task 1.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The documentation recommends git reset --hard <last_clean_commit> and force-push as a recovery step, both of which are destructive repository operations that can irreversibly discard uncommitted work or rewrite shared history. In an agent skill teaching autonomous workflows, including such commands without strong caution makes accidental data loss materially more likely.

Content

Scanner excerpt · SKILL.md (reported line 648)May include surrounding context.

md

## Known Pitfalls

- **`git checkout --theirs` during rebase can break cross-file imports silently.** When resolving merge conflicts by taking the upstream version of a file, that file may no longer match the import expectations of other files in the same stash/local branch. Classic example: taking upstream `llm.py` while the local `model_picker.py` imports `validate_model` from it — the function only exists in the local version. Always check what each conflicted file exports and what the other conflicted files import from it before resolving. When in doubt, don't resolve conflicts with `--theirs`/`--ours` blindly — read the diffs first. If a cascade of import errors follows a rebase, this is the likely cause. Fix: `git reset --hard <last_clean_commit>` and force-push to recover.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill promotes headless -y/--yolo operation that auto-approves file modifications without a nearby warning about destructive changes, validation, backups, or sandboxing. In the context of an autonomous coding agent, that omission materially raises the chance that users run broad write operations against the wrong repository or accept unsafe changes without review.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

The -y flag auto-approves all file changes and forces headless mode, removing the normal opportunity for users to inspect planned actions. For an agent that edits code and can run tools, this meaningfully increases the risk of unintended or unsafe modifications, especially when prompts are broad or input is attacker-influenced.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

cline -y "Add error handling to all API calls in src/"

text

`-y` / `--yolo` = auto-approve all file changes, forces headless mode.

## With Timeout (CI/CD)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 331)May include surrounding context.

md

| Flag | Effect |
|------|--------|
| `-y, --yolo` | Auto-approve all actions, forces headless mode |
| `--auto-approve-all` | Auto-approve but stay interactive (shows output) |
| `-p, --plan` | Plan mode: agent presents execution plan before writing code |
| `-a, --act` | Act mode: skip plan, execute immediately |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 332)May include surrounding context.

md

| Flag | Effect |
|------|--------|
| `-y, --yolo` | Auto-approve all actions, forces headless mode |
| `--auto-approve-all` | Auto-approve but stay interactive (shows output) |
| `-p, --plan` | Plan mode: agent presents execution plan before writing code |
| `-a, --act` | Act mode: skip plan, execute immediately |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 332)May include surrounding context.

md

| Flag | Effect |
|------|--------|
| `-y, --yolo` | Auto-approve all actions, forces headless mode |
| `--auto-approve-all` | Auto-approve but stay interactive (shows output) |
| `-p, --plan` | Plan mode: agent presents execution plan before writing code |
| `-a, --act` | Act mode: skip plan, execute immediately |
| `-m, --model <id>` | Override model (OpenRouter: `anthropic/claude-haiku-4-5`, etc.) |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 65% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 332)May include surrounding context.

md

| Flag | Effect |
|------|--------|
| `-y, --yolo` | Auto-approve all actions, forces headless mode |
| `--auto-approve-all` | Auto-approve but stay interactive (shows output) |
| `-p, --plan` | Plan mode: agent presents execution plan before writing code |
| `-a, --act` | Act mode: skip plan, execute immediately |
| `-m, --model <id>` | Override model (OpenRouter: `anthropic/claude-haiku-4-5`, etc.) |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 87% confidence

Finding

Autonomous mode being enabled by default means shell actions may execute without interactive confirmation, which is risky for a coding agent that can modify repositories and run commands. In this skill's context, default autonomy is more dangerous because the rest of the document encourages broad orchestration and background execution.

Content

Scanner excerpt · SKILL.md (reported line 424)May include surrounding context.

~/.cline/kanban/workspaces//boards.json # task state

text

Autonomous mode (no approval prompts) is on by default. Disable in config or UI if you need oversight of every shell command.

### Remote access (network binding)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation instructs users to bind the Kanban service to 0.0.0.0 for remote access but does not warn about exposing an autonomous agent control surface on the network. Because the service can manage tasks and trigger agent actions, network exposure substantially increases the attack surface and could permit unauthorized access if the environment is not otherwise protected.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 446)May include surrounding context.

md

# List all tasks (kanban server must be running)
kanban task list --project-path /path/to/project

# Create a task in backlog
kanban task create --prompt "Do X, Y, Z" --project-path /path/to/project

# Link tasks (create dependency chain)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file states cline task <prompt> is just an alias for running a task prompt (L357), while Kanban management is documented under the separate globally installed kanban task CLI (L440-L476). Yet the 'Full workflow example' uses cline task create, cline task start, cline task list, and cline task trash (L570-L588), which contradicts the earlier documented interface and is likely to mislead users about what command actually performs those actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

L637 says 'Kanban is a research preview. It's browser-based — no headless/programmatic API,' which directly conflicts with earlier sections that describe a 'full CLI' for creating, linking, starting, updating, and trashing tasks (L438-L476) and even show autonomous CLI workflows (L565-L590). This is an active contradiction in the file's own guidance, not merely omitted detail.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

L371 states 'Always export PATH — the binary is not in the default PATH,' while the installation section says 'No PATH configuration needed for standard npm installs' (L27). These instructions actively contradict each other and create ambiguity about the environment assumptions required to use the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.