adversarial-plan

• Outcome: Review
• Latest audit: Aug 3, 2026 · 6:27 PM UTC
• Version: 0.1.0

Overview

This appears to be a real planning/orchestration skill, but it documents unsafe install and execution patterns and has under-disclosed command-running behavior that users should review carefully.

Install only after reviewing the installer and pinning or verifying the source. Run this skill in a clean, backed-up repository, avoid the documented approval/sandbox bypass flags, use --no-merge until you trust the output, and do not enable --deep-research or delegated mode for sensitive specs unless you accept provider-side data exposure. Review any ac-directive blocks in specs before running because the artifact indicates directive-backed checks can execute local commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill advertises substantial capabilities including shell execution, filesystem access, environment usage, git operations, and remote/provider command execution, but does not declare permissions or surface these privileges explicitly. This weakens user consent and policy enforcement, making it easier for a user or orchestrator to invoke a powerful skill without understanding its effective attack surface.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The top-level description frames the skill as a planner that produces plan.md, but the body documents materially broader behavior: git branch manipulation, merges, rejection markers, adversarial review loops, delegated subprocesses, and optional external research. This mismatch can cause operators to approve or trust the skill under a narrower mental model than its real side effects, increasing the risk of unintended code execution or repository changes.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill advertises optional deep research and delegated multi-agent execution, which expands behavior beyond a local plan generator into provider-driven orchestration that may send project-derived content to external systems. That increases data exposure and operational risk, especially when users may reasonably expect a planning tool to operate only on local spec and findings inputs.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The deep research path derives queries from spec frontmatter and content, then sends them to an external provider command. Specs often contain proprietary roadmap, architecture, or vulnerability details, so this can exfiltrate sensitive information outside the local environment without strong minimization or policy checks.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The installation instructions encourage piping a remotely fetched script directly into bash, which executes unreviewed code from the network immediately. If the upstream repository, transport path, or referenced script is compromised, users can suffer arbitrary code execution during installation.

Natural-Language Policy Violations

High

• Confidence: 98% confidence
• Finding: The example execution command explicitly uses '--dangerously-bypass-approvals-and-sandbox' and '--skip-git-repo-check', normalizing unsafe defaults for downstream execution. In the context of an adversarial planning/execution pipeline, this significantly increases the chance that generated or reviewed steps run with excessive privileges and reduced containment.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The document explicitly instructs users to run `codex exec` with `--dangerously-bypass-approvals-and-sandbox`, which disables important safety controls while targeting a real repository path. Because the markdown presents this as part of a validated workflow without an adjacent warning, readers may normalize unsafe execution and run destructive or exfiltrating actions with reduced safeguards.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The example explicitly instructs use of `codex exec --dangerously-bypass-approvals-and-sandbox`, which removes normal approval and sandbox protections during automated code modification. In the context of an adversarial planning/execution workflow, this materially increases the chance that a malformed spec, prompt-injected input, or unsafe generated action can modify files or run commands without human review, making the reference operationally dangerous rather than merely descriptive.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: At the call site, external research is triggered from spec-derived queries with no interactive warning, confirmation, or per-run disclosure about outbound transmission. Even though it is behind a flag, the code path itself does not enforce informed consent or verify that the user understands sensitive repository content may be shared with third-party providers.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The example provider configuration includes a `codex exec --dangerously-bypass-approvals-and-sandbox` command, which explicitly disables safety controls and normal sandbox protections. Even though this appears in a spec/example rather than executable code, it can directly influence downstream implementation and operator behavior, normalizing insecure execution without any warning or constraint.

External Script Fetching

Low

• Category: Supply Chain

Content

Requires the `adversarial-common` sibling repo (shared engine). One-line install:

curl -fsSL https://raw.githubusercontent.com/chpomob/adversarial-plan/main/scripts/install.sh | bash

or, from an existing checkout:

• Confidence: 94% confidence
• Finding: curl -fsSL https://raw.githubusercontent.com/chpomob/adversarial-plan/main/scripts/install.sh | bash

External Script Fetching

Low

• Category: Supply Chain

Content

#!/usr/bin/env bash
# Install adversarial-plan with its single dependency: adversarial-common (sibling layout).
# Usage:
#   Bootstrap (from anywhere):  curl -fsSL https://raw.githubusercontent.com/chpomob/adversarial-plan/main/scripts/install.sh | bash
#   From a checkout:            bash scripts/install.sh [TARGET_DIR]
# Target layout (siblings required):
#   <TARGET>/adversarial-plan            (this skill)

• Confidence: 91% confidence
• Finding: curl -fsSL https://raw.githubusercontent.com/chpomob/adversarial-plan/main/scripts/install.sh | bash

Chaining Abuse

High

• Category: Tool Misuse

Content

Requires the `adversarial-common` sibling repo (shared engine). One-line install:

curl -fsSL https://raw.githubusercontent.com/chpomob/adversarial-plan/main/scripts/install.sh | bash

or, from an existing checkout:

• Confidence: 99% confidence
• Finding: | bash

Chaining Abuse

High

• Category: Tool Misuse

Content

#!/usr/bin/env bash
# Install adversarial-plan with its single dependency: adversarial-common (sibling layout).
# Usage:
#   Bootstrap (from anywhere):  curl -fsSL https://raw.githubusercontent.com/chpomob/adversarial-plan/main/scripts/install.sh | bash
#   From a checkout:            bash scripts/install.sh [TARGET_DIR]
# Target layout (siblings required):
#   <TARGET>/adversarial-plan            (this skill)

• Confidence: 96% confidence
• Finding: | bash

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.