Security audit

Flowdo

Security checks for vulnerabilities and agentic risk

Overview

FlowDo is not clearly malicious, but it needs review because the bundled script does not match the advertised kanban task manager and it stores local task and command-history data.

Review this before installing. Treat it as a simple local log utility rather than the advertised kanban task manager, and do not store secrets, credentials, or sensitive project details unless you are comfortable with them being written to local FlowDo data and history files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description says this is a task and workflow manager with kanban-style status tracking. However, the code is a simple Bash-based multi-purpose utility tool. It maintains a plain text log database, allows adding/listing/searching/exporting entries, prints fixed status/info messages, and records all command invocations in a history log. There are no task objects, boards, columns, statuses, workflow transitions, or kanban semantics. The 'remove' command only echoes a message and does not modify stored data. While local file storage is reasonable for a task tool, the actual implemented behavior materially differs from the declared purpose, so this is a mismatch.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description says "Use when you need flowdo," but it does not define specific activation phrases, scope boundaries, or exclusion conditions. This is ambiguous for a markdown skill description and could lead to unintended invocation because it provides no concrete trigger constraints beyond a generic need statement.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest says this skill is a task and workflow manager with kanban-style status tracking, but the script's own help text identifies it as a 'Multi-purpose utility tool' and exposes broad generic commands like run, config, init, export, and info. The implemented behavior is a simple flat log-based CLI, not a workflow or kanban-style manager as claimed by the manifest.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The comment at the top of the file and the help banner both describe the tool as a 'Multi-purpose utility tool'. That actively conflicts with the declared skill intent of being a task and workflow manager, signaling a divergence between stated intent and documented code purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The helper function persistently records command activity and arguments to a history file without clear user disclosure or consent. This can capture sensitive task names, search terms, or operational context in a durable local artifact, increasing the risk of privacy exposure to other local users, backups, or forensic collection.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The add command writes user-provided content to persistent storage with no prior warning, which may cause users to unknowingly store sensitive information on disk. In the context of a workflow/task manager, entries may include internal project names, credentials, tokens, or personal data, so undisclosed persistence meaningfully raises confidentiality risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.