Yandex Tracker CLI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:24 PM UTC
• Version: 1.2.8

Overview

This is a coherent Yandex Tracker CLI, but it needs review because it can delete Tracker data without confirmation and its attachment path protections can be bypassed with symlinks.

Review this before installing if the OAuth token can modify important Tracker data. Use the least-privileged token available, keep any ~/.yandex-tracker-env file private, manually confirm issue/comment/checklist IDs before destructive commands, and use a dedicated attachment directory without symlinks or sensitive files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: yandex-tracker.sh:102

Finding

Attachment directory restriction can be bypassed through symbolic links

Content

View full analysis

&2; return 1; } local base base=$(_get_attachment_base) || { echo "Error: could not determine allowed attachment directory" >&2; return 1; } if ! _path_under_base "$resolved" "$base"; then echo "Error: attachment path must be under the allowed directory (current directory or YANDEX_TRACKER_ATTACHMENTS_DIR)." >&2 return 1 fi return 0 } ``` ```bash attachment_download() { ensure_attachme ...[truncated 3800 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: yandex-tracker.sh:173

Finding

User-controlled arguments are interpolated into JSON without escaping

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The README instructs users to store an OAuth token and Org ID in environment variables or a plaintext file under the home directory, but gives no guidance on protecting those credentials. In a CLI context, this can lead to accidental disclosure through shell history, weak file permissions, backups, process inspection, or shared workstation access, enabling unauthorized API access to Tracker.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This is a markdown file, so SQP-2 applies to missing safety warnings in the skill description. The command list includes issue-delete and issue-comment-delete, but the README provides no caution that these operations modify or remove remote Tracker data and may be irreversible.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill clearly instructs use of shell-executable artifacts and command execution, but it does not declare any explicit tool scope or allowed-tools policy. In agent environments, this increases the chance that the skill will be granted overly broad shell access by default, making misuse or prompt-driven command execution harder to constrain.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file's user-facing instructions, command explanations, and safety guidance are presented only in Russian. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicit and justified, which is not stated here.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

1. Скопируйте скрипт в директорию в PATH:

bash

mkdir -p ~/bin
cp yandex-tracker.sh ~/bin/yandex-tracker
chmod +x ~/bin/yandex-tracker

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

1. Cкoпиpyйтe cкpипт в диpeктopию в PATH:

bash

mkdir -p ~/bin
cp yandex-tracker.sh ~/bin/yandex-tracker
chmod +x ~/bin/yandex-tracker

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

TOKEN='y0__...' ORG_ID='1234...'

text

Предпочтительно задавать учётные данные переменными окружения. Если используете файл — установите права `chmod 600 ~/.yandex-tracker-env`.

3. Убедитесь, что `jq` установлен:
```bash

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

3. Убедитесь, что jq установлен:

bash

sudo apt install jq   # Ubuntu/Debian
# или
brew install jq       # macOS

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation claims attachment upload/download paths are restricted to a safe directory, but this file contains only policy text and no enforcement. If the underlying script does not actually canonicalize and validate paths, an agent or user could read from or write to arbitrary local files, including secrets and sensitive system locations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · yandex-tracker.sh (reported line 39)May include surrounding context.

sh

exit 1
fi

BASE="https://api.tracker.yandex.net/v2"
BASE_V3="https://api.tracker.yandex.net/v3"
AUTH="Authorization: OAuth $TOKEN"
ORG="X-Org-Id: $ORG_ID"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · yandex-tracker.sh (reported line 40)May include surrounding context.

sh

exit 1
fi

BASE="https://api.tracker.yandex.net/v2"
BASE_V3="https://api.tracker.yandex.net/v3"
AUTH="Authorization: OAuth $TOKEN"
ORG="X-Org-Id: $ORG_ID"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · yandex-tracker.sh (reported line 186)May include surrounding context.

sh

.tags = ((.tags // [] | map(tostring)) + ["yandex-tracker-cli"] | unique)
    ')
  fi
  curl -sS -X POST -H "$AUTH" -H "$ORG" -H "Content-Type: application/json" \
    -d "$body" "$BASE/issues"
}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · yandex-tracker.sh (reported line 198)May include surrounding context.

sh

payload=$(echo "$payload" | jq '
    .tags = ((.tags // [] | map(tostring)) + ["yandex-tracker-cli"] | unique)
  ')
  curl -sS -X PATCH -H "$AUTH" -H "$ORG" -H "Content-Type: application/json" \
    -d "$payload" "$BASE/issues/$(urlencode "$id")"
}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The CLI exposes issue deletion as a single-step command with no confirmation prompt, dry-run mode, or safety interlock. In an agent or automation context, a malformed prompt, typo, or unintended invocation can permanently remove issue data with little friction.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · yandex-tracker.sh (reported line 279)May include surrounding context.

sh

else
    form_data=""
  fi
  curl -sS -X POST -H "$AUTH" -H "$ORG" \
    -F "file=@$filepath;filename=$file_name" \
    ${form_data:+-F "$form_data"} \
    "$BASE/issues/$(urlencode "$issue_id")/attachments"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Comment deletion is irreversible content removal and currently happens without any user-facing warning or confirmation. In interactive or agent-driven use, this increases the risk of accidental deletion of audit-relevant discussion or instructions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes a CLI for Yandex Tracker focused on queues, issues, comments, worklogs, attachments, and YQL. The code also implements sprint, project, users, statuses, resolutions, issue types, checklist, and export-report operations, which materially broaden the skill beyond the stated scope rather than serving as an obvious implementation detail of the listed features.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · yandex-tracker.sh (reported line 337)May include surrounding context.

sh

perPage="?perPage=50&page=$pg"
    fi
  fi
  curl -sS -X POST -H "$AUTH" -H "X-Org-ID: $ORG_ID" -H "Content-Type: application/json" \
    -d "$payload" "$BASE_V3/issues/_search${perPage}"
}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · yandex-tracker.sh (reported line 409)May include surrounding context.

sh

if [[ -z "$text" ]]; then
    text="(item)"
  fi
  curl -sS -X PATCH -H "$AUTH" -H "$ORG" -H "Content-Type: application/json" \
    -d "$(jq -n --arg t "$text" --argjson ch true '{text: $t, checked: $ch}')" \
    "$BASE_V3/issues/$(urlencode "$issue_id")/checklistItems/$(urlencode "$item_id")"
}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Checklist item deletion is a destructive action that proceeds immediately with no confirmation barrier. While lower impact than deleting issues, it can still silently remove task-tracking data and mislead teams about completion state.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 70% confidence

Finding

SQP-3 applies to all file types and includes language or locale policy violations. The entire user-facing README is in Russian with no indication of optional language support, opt-in, or a documented region-specific justification.

Content

No source excerpt is available for this finding.