OrchardOS

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:21 AM UTC
• Version: 0.2.5-rc.5

Overview

This appears to be a legitimate project-management plugin, but it has serious security and privacy risks that should be reviewed before installation.

Review before installing. Use only in an environment where gateway tokens, task content, run output, and project knowledge can be treated as sensitive persistent data. Disable contextInjection unless you explicitly want external embeddings, avoid storing API keys in plugin config until /orchard/config redacts them, keep the standalone UI loopback-only, and fix the dashboard XSS and document-fetch SSRF issues before using it with privileged tokens or confidential projects.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: src/ui/dashboard.html:715

Finding

Persistent Cross-Site Scripting in Project Navigation Can Compromise Gateway Credentials

Content

View full analysis

`

${escapeHtml(project.name)}

${percent(project.completion_score)}% complete

${badge(projectStatus(project))}

`).join('') : '

No projects yet.

'; ``` ### Technical Analysis Project IDs originate from authenticated API input and are persisted in SQLite. The dashboard later inserts each ID into an inline JavaScript event handler assigned through `innerHTML`. `encodeURIComponent()` is URL encoding, not JavaScript-string escaping. In particular, it does not encode apostrophes. A crafted project ID can therefore terminate the single-quoted argument passed to `navigate()` and introduce additional JavaScript. An attacker can use an alphanumeric Base64 payload with an expression such as `eval(atob(...))`, avoiding many characters that `encodeURIComponent()` would otherwise encode. The issue is more ...[truncated 1836 chars]

Remediation

View remediation

{ navigate(`#project/${encodeURIComponent(project.id)}`); }); ``` 2. Construct untrusted content using `textContent`, DOM methods, or a template system with contextual escaping rather than `innerHTML`. 3. Apply separate encoders for HTML text, HTML attributes, URLs, and JavaScript strings; HTML escaping alone is not sufficient for executable contexts. 4. Stop storing a gateway bearer token in `localStorage`. Prefer an `HttpOnly`, `Secure`, and `SameSite=Strict` cookie or a short-lived, narrowly scoped UI session. 5. Add a restrictive Content Security Policy that disallows inline scripts and event handlers, for example with nonce-based scripts and no `unsafe-inline`. 6. Regenerate `src/ui/dashboard.generated.ts` after correcting `dashboard.html`. 7. Add security tests using project IDs containing apostrophes, parentheses, HTML metacharacters, and encoded JavaScript payloads. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: src/api/routes.ts:615

Finding

Authenticated Configuration Endpoint Returns the Gemini API Key

Content

View full analysis

{ const cfg = getCfg ? getCfg() : ({} as OrchardConfig); const allowModelOverride = cfg.allowModelOverride === true; return jsonOk(res, { ...cfg, allowModelOverride }); }, }); ``` ### Technical Analysis The `/orchard/config` handler serializes the entire `OrchardConfig` object using object spread. The configuration type contains `contextInjection.apiKey`, so a key configured directly in the plugin entry is returned verbatim in the HTTP response. Gateway authentication does not eliminate the need to redact secrets. A principal may legitimately require access to the dashboard or task APIs without needing permission to recover third-party provider credentials. Returning the raw configuration violates least privilege and unnecessarily increases the consequences of gateway-token compromise. ### Attack Path 1. An attacker obtains a valid gateway bearer token or compromises an authenticated dashboard context. 2. The attacker sends: ```http GET /orchard/config Authorization: Bearer ``` 3. The route serializes the complete plugin configuration. 4. If `contextInjection.apiKey` was configured, the response contains the API key in plaintext. 5. The attacker extracts and reuses the key against the associated Google API account. ### Impact Assessment The attacke ...[truncated 543 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/api/routes.ts:48

Finding

DNS Rebinding Can Bypass Document-Fetch SSRF Protection

Content

View full analysis

= 16 && b <= 31) return true; if (a === 192 && b === 168) return true; if (a === 169 && b === 254) return true; // link-local if (a === 0) return true; } if (hostname === "::1" || hostname.startsWith("fc") || hostname.startsWith("fd")) return true; return false; } function fetchUrl(url: string, maxChars = 2000, _redirectDepth = 0): Promise { return new Promise((resolve, reject) => { if (_redirectDepth > 3) return reject(new Error("Too many redirects")); let parsed: URL; try { parsed = new URL(url); } catch { return reject(new Error("Invalid URL")); } if (parsed.protocol !== "http:" && parsed.protocol !== "https:") { return reject(new Error("Only http/https URLs are allowed")); } if (isPrivateHost(parsed.hostname)) { return reject(new Error("Requests to private/internal addresses are not allowed")); } const lib = url.startsWith("https") ? https : http; const req = lib.get(url, { timeout: 10000, headers: { "User-Agent": "OrchardOS/1.0" } }, (res) => { if ( res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location ) { res.resume(); return fetchUrl( res.headers.location, maxChars, _redirectDepth + 1 ).then(resolve).catch(reject); } // Resp ...[truncated 2681 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/kb/knowledge.ts:15

Finding

Ambient Gemini Credential Implicitly Enables Transmission of Project and Task Data

Content

View full analysis

{ const apiKey = getApiKey(cfg); if (!apiKey) return []; const model = cfg.contextInjection?.model ?? "gemini-embedding-001"; const body = JSON.stringify({ content: { parts: [{ text }] } }); return new Promise((resolve) => { const url = `https://generativelanguage.googleapis.com/v1beta/models/` + `${model}:embedContent?key=${apiKey}`; const req = https.request( url, { method: "POST", headers: { "Content-Type": "application/json" } }, (res) => { let data = ""; res.on("data", (c: Buffer) => { data += c; }); res.on("end", () => { try { const json = JSON.parse(data); const values = json?.embedding?.values; resolve(Array.isArray(values) ? values : []); } catch { resolve([]); } }); } ); req.write(body); req.end(); }); } ``` ```typescript export async function addKnowledge( db: Database.Database, cfg: OrchardConfig, projectId: string, content: string, source: string, taskId?: number ): Promise { let embeddingJson: string | null = null; if (isEnabled(cfg)) { try { const vec = await embedText(co ...[truncated 3116 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (57)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The stated function is project/task management, but the code reportedly also includes knowledge-base storage, semantic search, and project knowledge retrieval. Undisclosed retention and retrieval functions are risky because they expand the data collection surface and may expose sensitive project information to agents or interfaces that users did not expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The stated function is project/task management, but the code reportedly also includes knowledge-base storage, semantic search, and project knowledge retrieval. Undisclosed retention and retrieval functions are risky because they expand the data collection surface and may expose sensitive project information to agents or interfaces that users did not expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The stated function is project/task management, but the code reportedly also includes knowledge-base storage, semantic search, and project knowledge retrieval. Undisclosed retention and retrieval functions are risky because they expand the data collection surface and may expose sensitive project information to agents or interfaces that users did not expect.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: openclaw==2026.3.24 — 16 advisory(ies): CVE-2026-53846 (OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency); CVE-2026-41913 (OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret r); CVE-2026-53830 (OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reloa) +13 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

This lockfile pins a local file-linked dependency to openclaw version 2026.3.24, and the static finding reports multiple known advisories affecting that exact version. Because OrchardOS is an agentic task-management plugin with REST/API, queue runner, subagent dispatch, and dashboard capabilities, vulnerabilities in the host agent framework can materially expand attack surface and increase the likelihood of secret exposure, auth bypass, or runtime compromise.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: openclaw==2026.3.24 — 16 advisory(ies): CVE-2026-53846 (OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency); CVE-2026-41913 (OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret r); CVE-2026-53830 (OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reloa) +13 more

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The package declares a peer dependency of "openclaw": "*", and the finding ties the deployed/resolved version to openclaw 2026.3.24 with multiple known advisories. In the context of an agentic plugin with REST API, queue runner, dashboard, and persistent task execution, inheriting a vulnerable host framework materially increases exposure because flaws in auth, secret handling, or workspace/runtime isolation can directly affect plugin operations and user data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code fetches attacker-controlled external URLs and injects the retrieved content into generated instruction text. Although it blocks some private IP ranges, it still enables untrusted remote content to influence agent behavior and the redirect handling does not robustly constrain final destinations across all SSRF edge cases such as DNS rebinding or alternative internal address representations.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Deleting config-safety profiles through a broadly reachable gateway-authenticated route is security-relevant because these profiles influence what safety/context instructions are injected elsewhere. An attacker with gateway-level access could remove safeguards or operational guidance, weakening downstream controls and enabling less constrained agent behavior.

Content

Scanner excerpt · src/api/routes.ts (reported line 808)May include surrounding context.

ts

return jsonOk(res, updated);
      }

      // DELETE /orchard/config-safety/:id
      if (!sub && req.method === "DELETE") {
        const existing = db.prepare(`SELECT * FROM config_safety_profiles WHERE id = ?`).get(profileId);
        if (!existing) return jsonErr(res, 404, `Profile '${profileId}' not found`);

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 75% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · src/index.ts (reported line 46)May include surrounding context.

ts

const uiServerAllowUnsafeBind = cfg.uiServer?.allowUnsafeBind === true;
    api.logger.info(`[orchard] initializing, db: ${dbPath}`);
    if (cfg.debug?.enabled) {
      api.logger.warn(`[orchard] debug mode enabled (env overrides supported)`);
    }

    if (cfg.contextInjection?.enabled && !cfg.contextInjection.apiKey && !process.env.GEMINI_API_KEY) {

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · src/ui/dashboard.generated.ts (reported line 4)May include surrounding context.

ts

// Auto-generated by scripts/generate-dashboard-module.mjs
// Do not edit by hand; edit src/ui/dashboard.html and regenerate.

export const DASHBOARD_HTML = "<!DOCTYPE html>\n<html lang=\"en\" data-theme=\"dark\">\n<head>\n  <meta charset=\"utf-8\">\n  <meta http-equiv=\"Cache-Control\" content=\"no-cache, no-store, must-revalidate\">\n  <meta http-equiv=\"Pragma\" content=\"no-cache\">\n  <meta http-equiv=\"Expires\" content=\"0\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n  <title>OrchardOS</title>\n  <style>\n    @import url(\"data:text/css,\"); /* no CDN deps — system fonts only */\n  </style>\n  <link rel=\"icon\" href=\"data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='%23ff5c5c'><path d='M12 2L8 6h3v4H7l5 5 5-5h-4V6h3L12 2zM4 18h16v2H4v-2z'/></svg>\">\n  <style>\n    * { box-sizing: border-box; margin: 0; padding: 0; }\n    html, body { height: 100%; }\n    :root, [data-theme=\"dark\"] {\n      --bg: #0e1015; --bg-accent: #13151b; --bg-elevated: #191c24; --bg-hover: #1f2330;\n      --card: #161920; --text: #d4d4d8; --text-strong: #f4f4f5; --muted: #52525b;\n      --border: #1e2028; --border-strong: #2e3040;\n      --accent: #ff5c5c; --accent-hover: #ff7070; --accent-subtle: rgba(255,92,92,0.12);\n      --ok: #22c55e; --warn: #f59e0b; --danger: #ef4444; --info: #3b82f6; --teal: #14b8a6;\n      --radius-sm: 6px; --radius-md: 10px; --radius-lg: 16px;\n      --font-body: -apple-system, BlinkMacSystemFont, \"Segoe UI\", Helvetica, Arial, sans-serif;\n      --mono: \"SFMono-Regular\", Consolas, \"Liberation Mono\", Menlo, monospace;\n      --shadow: 0 1px 3px rgba(0,0,0,0.4);\n    }\n    [data-theme=\"light\"] {\n      --bg: #f5f6fa; --bg-accent: #ffffff; --bg-elevated: #eef0f6; --bg-hover: #e8eaf2;\n      --card: #ffffff; --text: #374151; --text-strong: #111827; --muted: #9ca3af;\n      --border: #e5e7eb; --border-strong: #d1d5db;\n      --accent: #e03131; --accent-hover: #c92a2a; --accent-subtl
...[truncated 28 chars]

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · src/ui/dashboard.html (reported line 1453)May include surrounding context.

html

// Auto-generated by scripts/generate-dashboard-module.mjs
// Do not edit by hand; edit src/ui/dashboard.html and regenerate.

export const DASHBOARD_HTML = "<!DOCTYPE html>\n<html lang=\"en\" data-theme=\"dark\">\n<head>\n  <meta charset=\"utf-8\">\n  <meta http-equiv=\"Cache-Control\" content=\"no-cache, no-store, must-revalidate\">\n  <meta http-equiv=\"Pragma\" content=\"no-cache\">\n  <meta http-equiv=\"Expires\" content=\"0\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n  <title>OrchardOS</title>\n  <style>\n    @import url(\"data:text/css,\"); /* no CDN deps — system fonts only */\n  </style>\n  <link rel=\"icon\" href=\"data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='%23ff5c5c'><path d='M12 2L8 6h3v4H7l5 5 5-5h-4V6h3L12 2zM4 18h16v2H4v-2z'/></svg>\">\n  <style>\n    * { box-sizing: border-box; margin: 0; padding: 0; }\n    html, body { height: 100%; }\n    :root, [data-theme=\"dark\"] {\n      --bg: #0e1015; --bg-accent: #13151b; --bg-elevated: #191c24; --bg-hover: #1f2330;\n      --card: #161920; --text: #d4d4d8; --text-strong: #f4f4f5; --muted: #52525b;\n      --border: #1e2028; --border-strong: #2e3040;\n      --accent: #ff5c5c; --accent-hover: #ff7070; --accent-subtle: rgba(255,92,92,0.12);\n      --ok: #22c55e; --warn: #f59e0b; --danger: #ef4444; --info: #3b82f6; --teal: #14b8a6;\n      --radius-sm: 6px; --radius-md: 10px; --radius-lg: 16px;\n      --font-body: -apple-system, BlinkMacSystemFont, \"Segoe UI\", Helvetica, Arial, sans-serif;\n      --mono: \"SFMono-Regular\", Consolas, \"Liberation Mono\", Menlo, monospace;\n      --shadow: 0 1px 3px rgba(0,0,0,0.4);\n    }\n    [data-theme=\"light\"] {\n      --bg: #f5f6fa; --bg-accent: #ffffff; --bg-elevated: #eef0f6; --bg-hover: #e8eaf2;\n      --card: #ffffff; --text: #374151; --text-strong: #111827; --muted: #9ca3af;\n      --border: #e5e7eb; --border-strong: #d1d5db;\n      --accent: #e03131; --accent-hover: #c92a2a; --accent-subtl
...[truncated 28 chars]

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The dashboard exposes watchdog actions that can create snapshots and trigger a gateway restart directly from the browser UI. For a task/project management plugin, this is privileged operational control over the host gateway, and if the UI or token is compromised an attacker could disrupt service, force restarts, or extract potentially sensitive state via snapshots.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 117)May include surrounding context.

md

Use these directly inside any OpenClaw agent session:

- `orchard_task_add` — add a task to a project
- `orchard_task_list` — list tasks (filter by project_id, status)
- `orchard_task_done` — mark task done with summary
- `orchard_task_block` — mark task blocked with reason

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence

Finding

The skill metadata does not declare any tool scope or permission boundaries even though the plugin behavior implies access to environment and network-capable functionality. In an agent ecosystem, missing explicit scope increases the chance that the plugin is invoked with broader privileges than users expect, enabling unintended data access or outbound communication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description does not clearly warn that project and task data is persisted in SQLite and exposed via API and dashboard interfaces. That omission can lead users to share sensitive information with the plugin without understanding retention, visibility, and exposure boundaries, increasing confidentiality and privacy risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation states the tools are available in every agent session after install, with no constraints on when they should activate. Broad activation increases the probability that unrelated agents can read or modify persistent project state, trigger queue execution, or interact with the dashboard/API in contexts where those capabilities are unnecessary.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The plugin intentionally persists tasks, comments, summaries, and run history across sessions, which creates durable state that may contain sensitive operational or user data. Session persistence is not inherently malicious, but without retention limits, access controls, or user warning, it increases the blast radius of accidental disclosure or misuse.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

|------|-------------|
| `orchard_project_create` | Create a new project |
| `orchard_project_list` | List all projects |
| `orchard_task_add` | Add a task to a project |
| `orchard_task_list` | List tasks (filter by project, status) |
| `orchard_task_done` | Mark a task done with a summary |
| `orchard_task_block` | Mark a task blocked with a reason |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The brief explicitly instructs the operator to use a real local gateway token in a manual smoke test, but provides no guidance on safe handling, scoping, storage, or redaction. In an agent-skill context, asking for real credentials increases the chance that a token is exposed in shell history, logs, transcripts, screenshots, or pasted back into tool outputs, which could enable unauthorized API access.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · src/api/routes.ts (reported line 116)May include surrounding context.

ts

// ── standalone UI proxy server ────────────────────────────────────────────────

function getDashboardHtml(stripLegacyAuth = false): string {
  return stripLegacyAuth ? DASHBOARD_HTML.replace(/const AUTH = '[^']*'/, "const AUTH = ''") : DASHBOARD_HTML;
}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains a destructive operation: deleting a task record from the database. Although the route checks for existence and blocks deletion while running, the handler provides no confirmation prompt, warning log, or explanatory comment disclosing that the operation is irreversible from the user's perspective.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This route adds a configuration-safety/profile injection subsystem that is materially broader than the plugin’s stated task/project-management scope. In practice it can assemble prompt material from remote URLs, local knowledge sources, and custom rules into an injection payload, which creates a powerful control surface for steering downstream agent behavior and increases the blast radius if abused by any authenticated caller.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Deleting knowledge entries affects stored user/project data and is safety-relevant under SQP-2 for code files. The handler executes the deletion directly after existence checking, but does not include any visible confirmation step, warning log, or explanatory comment about the data-removal effect.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This module transmits arbitrary project knowledge content to Google's embedding API, which can include sensitive task, project, or operational data. Although this appears to support semantic search rather than overtly malicious behavior, the external data transfer expands the trust boundary and creates a confidentiality/privacy risk that is not clearly constrained in this code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code sends user/project content directly to an external API when embeddings are enabled, but there is no visible disclosure, approval flow, or sensitivity check here. In a task-management skill, stored content may contain credentials, internal plans, or personal data, so silent export to a third party can violate privacy expectations and compliance requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Search queries are also embedded remotely, which exposes what users are looking for and may reveal sensitive project intent, incident details, or internal identifiers. Even if content storage is expected, transmitting live queries to a third party without clear disclosure increases privacy and operational security risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The executor dispatch sends task title, description, acceptance criteria, project goal, and possibly retrieved knowledge-base context to a subagent session. That is a real data-exposure boundary: sensitive project/task content can be propagated to another model/runtime without any consent gate, redaction layer, or data-classification check in this code path.

Content

No source excerpt is available for this finding.