Orchard

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:12 AM UTC
• Version: 0.2.5-rc.5

Overview

OrchardOS is a real task-board plugin, but it handles stored project knowledge, credentials, prompt-injection text, and external requests in ways that need careful review before installation.

Install only if you are comfortable with an autonomous task runner that stores project data, can spawn subagents, and may reuse stored content in future prompts. Before enabling it, turn off contextInjection unless you explicitly want Gemini embeddings, do not put provider API keys directly in plugin config until /orchard/config redacts them, keep the UI bound to 127.0.0.1, avoid passing gateway tokens on command lines or over plain HTTP, and restrict who can access gateway-authenticated Orchard routes.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: src/api/routes.ts:617

Finding

Plugin Configuration Endpoint Exposes the Gemini API Key

Content

View full analysis

{ const cfg = getCfg ? getCfg() : ({} as OrchardConfig); const allowModelOverride = cfg.allowModelOverride === true; return jsonOk(res, { ...cfg, allowModelOverride }); }, }); ``` ### Technical Analysis The `/orchard/config` endpoint returns the entire plugin configuration using object spread. The `OrchardConfig` structure includes `contextInjection.apiKey`, so a Gemini API key configured directly in the plugin configuration is serialized and returned verbatim. Gateway authentication limits access to clients possessing a gateway bearer token, but it does not make disclosure of unrelated third-party credentials necessary. Dashboard clients only require non-sensitive operational settings and should never receive provider API keys. ### Attack Path 1. An attacker obtains or is granted a valid OpenClaw gateway bearer token. 2. The attacker sends `GET /orchard/config`. 3. The route serializes the complete configuration object. 4. If `contextInjection.apiKey` is configured, the response exposes it in plaintext. 5. The attacker uses the key to submit requests to the Gemini API or consume the associated quota. ### Impact Assessment A gateway-authenticated user can obtain a third-party API credential that is not required for normal dashboard operation. This may permit unauthorized API requests, quota exhaustion, billing impact, and access to any additional services or projects authorized by the exposed key. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/kb/knowledge.ts:14

Finding

Ambient GEMINI_API_KEY Silently Enables External Transmission of Project Content

Content

View full analysis

{ const apiKey = getApiKey(cfg); if (!apiKey) return []; const model = cfg.contextInjection?.model ?? "gemini-embedding-001"; const body = JSON.stringify({ content: { parts: [{ text }] } }); return new Promise((resolve) => { const url = `https://generativelanguage.googleapis.com/v1beta/models/${model}:embedContent?key=${apiKey}`; const req = https.request(url, { method: "POST", headers: { "Content-Type": "application/json" } }, (res) => { let data = ""; res.on("data", (c: Buffer) => { data += c; }); res.on("end", () => { try { const json = JSON.parse(data); const values = json?.embedding?.values; resolve(Array.isArray(values) ? values : []); } catch { resolve([]); } }); }); req.on("error", () => resolve([])); req.setTimeout(10000, () => { req.destroy(); resolve([]); }); req.write(body); req.end(); }); } ``` Automatic extraction also occurs after successful execution: ```ts if (finalStatus === "done" && cfg.contextInjection?.autoExtract !== false && output) { addKnowledge(db, cfg, project.id, output, "executor_output", task.id).catch(() => {}); } ``` ### Technical Analysis Embedding is active unless `contextInjection.enabled` is explicitly set ...[truncated 1501 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/api/routes.ts:46

Finding

DNS-Based SSRF Bypasses Private-Address Validation

Content

View full analysis

= 16 && b <= 31) return true; if (a === 192 && b === 168) return true; if (a === 169 && b === 254) return true; // link-local if (a === 0) return true; } if (hostname === "::1" || hostname.startsWith("fc") || hostname.startsWith("fd")) return true; return false; } function fetchUrl(url: string, maxChars = 2000, _redirectDepth = 0): Promise { return new Promise((resolve, reject) => { if (_redirectDepth > 3) return reject(new Error("Too many redirects")); let parsed: URL; try { parsed = new URL(url); } catch { return reject(new Error("Invalid URL")); } if (parsed.protocol !== "http:" && parsed.protocol !== "https:") { return reject(new Error("Only http/https URLs are allowed")); } if (isPrivateHost(parsed.hostname)) { return reject(new Error("Requests to private/internal addresses are not allowed")); } const lib = url.startsWith("https") ? https : http; const req = lib.get(url, { timeout: 10000, headers: { "User-Agent": "OrchardOS/1.0" } }, (res) => { if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) { res.resume(); return fetchUrl(res.headers.location, maxChars, _redirectDepth + 1).then(resolve).catch(reject); } // Response handling omitted here only after the vulnerable connection is established. }); }); } ``` The fetched respo ...[truncated 2365 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: src/api/routes.ts:647

Finding

Persistent Custom and Remote Content Is Presented as Mandatory Agent Instructions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/standalone-ui-smoke.mjs:16

Finding

Smoke-Test Script Sends Gateway Tokens to Arbitrary Plaintext URLs

Content

View full analysis

npm run smoke:standalone-ui -- --base-url http://10.50.0.10:18790 --token ``` ### Technical Analysis The script accepts an unrestricted `--base-url` and attaches the gateway bearer token to requests without validating the URL scheme or destination. It therefore permits sending a high-value authentication token over plaintext HTTP or directly to an attacker-controlled host. The documented LAN example uses `http://`, making interception on the network a realistic operational risk. Supplying the token as a command-line argument may also expose it through shell history and process-list inspection. ### Attack Path 1. A user follows the documented remote-host example, connects through an untrusted network, or is persuaded to use an attacker-provided base URL. 2. The user passes the gateway token through `--token`. 3. The script constructs an `Authorization: Bearer` header. 4. The token is transmitted over plaintext HTTP or directly to the attacker-controlled destination. 5. The attacker captures the token. 6. The a ...[truncated 515 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (60)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Undocumented knowledge-base storage and semantic search add persistence and data retrieval capabilities beyond the stated task-board role. In an agentic environment, hidden KB features can increase data retention risk, broaden what information subagents can discover, and create additional injection or privacy exposure if content is indexed and reused in prompts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Undocumented knowledge-base storage and semantic search add persistence and data retrieval capabilities beyond the stated task-board role. In an agentic environment, hidden KB features can increase data retention risk, broaden what information subagents can discover, and create additional injection or privacy exposure if content is indexed and reused in prompts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Undocumented knowledge-base storage and semantic search add persistence and data retrieval capabilities beyond the stated task-board role. In an agentic environment, hidden KB features can increase data retention risk, broaden what information subagents can discover, and create additional injection or privacy exposure if content is indexed and reused in prompts.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: openclaw==2026.3.24 — 16 advisory(ies): CVE-2026-53846 (OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency); CVE-2026-41913 (OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret r); CVE-2026-53830 (OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reloa) +13 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

This is a true supply-chain vulnerability finding: the lockfile pins a local file dependency to openclaw version 2026.3.24, and the static analysis indicates that exact version has multiple published advisories, including issues affecting authentication, secret lifecycle handling, and workspace/environment influence over runtime behavior. In the context of an agentic task-management plugin with REST API, queue runner, subagent dispatch, persistent storage, and dashboard access, flaws in the underlying OpenClaw runtime materially increase the risk of unauthorized access, secret misuse, agent hijacking, or workspace-level compromise.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: openclaw==2026.3.24 — 16 advisory(ies): CVE-2026-53846 (OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency); CVE-2026-41913 (OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret r); CVE-2026-53830 (OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reloa) +13 more

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The manifest declares a peer dependency on OpenClaw without constraining away a host version flagged as vulnerable, and the static analysis specifically identifies openclaw==2026.3.24 with numerous advisories. Because this plugin is an agentic task-management extension with REST API, queue runner, and subagent dispatch capabilities, running it inside a vulnerable OpenClaw host can materially increase attack surface and amplify the impact of host-level flaws such as auth bypass, secret handling issues, or workspace influence vulnerabilities.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · src/api/routes.ts (reported line 808)May include surrounding context.

ts

return jsonOk(res, updated);
      }

      // DELETE /orchard/config-safety/:id
      if (!sub && req.method === "DELETE") {
        const existing = db.prepare(`SELECT * FROM config_safety_profiles WHERE id = ?`).get(profileId);
        if (!existing) return jsonErr(res, 404, `Profile '${profileId}' not found`);

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 75% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · src/index.ts (reported line 46)May include surrounding context.

ts

const uiServerAllowUnsafeBind = cfg.uiServer?.allowUnsafeBind === true;
    api.logger.info(`[orchard] initializing, db: ${dbPath}`);
    if (cfg.debug?.enabled) {
      api.logger.warn(`[orchard] debug mode enabled (env overrides supported)`);
    }

    if (cfg.contextInjection?.enabled && !cfg.contextInjection.apiKey && !process.env.GEMINI_API_KEY) {

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code transmits raw task/project knowledge content to Google's embedding API, which is an external third party. Because the skill is described as project/task management and the external data export is not clearly disclosed here, sensitive internal notes, tasks, or project data could be sent off-host unexpectedly, creating a confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · src/ui/dashboard.generated.ts (reported line 4)May include surrounding context.

ts

// Auto-generated by scripts/generate-dashboard-module.mjs
// Do not edit by hand; edit src/ui/dashboard.html and regenerate.

export const DASHBOARD_HTML = "<!DOCTYPE html>\n<html lang=\"en\" data-theme=\"dark\">\n<head>\n  <meta charset=\"utf-8\">\n  <meta http-equiv=\"Cache-Control\" content=\"no-cache, no-store, must-revalidate\">\n  <meta http-equiv=\"Pragma\" content=\"no-cache\">\n  <meta http-equiv=\"Expires\" content=\"0\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n  <title>OrchardOS</title>\n  <style>\n    @import url(\"data:text/css,\"); /* no CDN deps — system fonts only */\n  </style>\n  <link rel=\"icon\" href=\"data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='%23ff5c5c'><path d='M12 2L8 6h3v4H7l5 5 5-5h-4V6h3L12 2zM4 18h16v2H4v-2z'/></svg>\">\n  <style>\n    * { box-sizing: border-box; margin: 0; padding: 0; }\n    html, body { height: 100%; }\n    :root, [data-theme=\"dark\"] {\n      --bg: #0e1015; --bg-accent: #13151b; --bg-elevated: #191c24; --bg-hover: #1f2330;\n      --card: #161920; --text: #d4d4d8; --text-strong: #f4f4f5; --muted: #52525b;\n      --border: #1e2028; --border-strong: #2e3040;\n      --accent: #ff5c5c; --accent-hover: #ff7070; --accent-subtle: rgba(255,92,92,0.12);\n      --ok: #22c55e; --warn: #f59e0b; --danger: #ef4444; --info: #3b82f6; --teal: #14b8a6;\n      --radius-sm: 6px; --radius-md: 10px; --radius-lg: 16px;\n      --font-body: -apple-system, BlinkMacSystemFont, \"Segoe UI\", Helvetica, Arial, sans-serif;\n      --mono: \"SFMono-Regular\", Consolas, \"Liberation Mono\", Menlo, monospace;\n      --shadow: 0 1px 3px rgba(0,0,0,0.4);\n    }\n    [data-theme=\"light\"] {\n      --bg: #f5f6fa; --bg-accent: #ffffff; --bg-elevated: #eef0f6; --bg-hover: #e8eaf2;\n      --card: #ffffff; --text: #374151; --text-strong: #111827; --muted: #9ca3af;\n      --border: #e5e7eb; --border-strong: #d1d5db;\n      --accent: #e03131; --accent-hover: #c92a2a; --accent-subtl
...[truncated 28 chars]

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · src/ui/dashboard.html (reported line 1453)May include surrounding context.

html

// Auto-generated by scripts/generate-dashboard-module.mjs
// Do not edit by hand; edit src/ui/dashboard.html and regenerate.

export const DASHBOARD_HTML = "<!DOCTYPE html>\n<html lang=\"en\" data-theme=\"dark\">\n<head>\n  <meta charset=\"utf-8\">\n  <meta http-equiv=\"Cache-Control\" content=\"no-cache, no-store, must-revalidate\">\n  <meta http-equiv=\"Pragma\" content=\"no-cache\">\n  <meta http-equiv=\"Expires\" content=\"0\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n  <title>OrchardOS</title>\n  <style>\n    @import url(\"data:text/css,\"); /* no CDN deps — system fonts only */\n  </style>\n  <link rel=\"icon\" href=\"data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='%23ff5c5c'><path d='M12 2L8 6h3v4H7l5 5 5-5h-4V6h3L12 2zM4 18h16v2H4v-2z'/></svg>\">\n  <style>\n    * { box-sizing: border-box; margin: 0; padding: 0; }\n    html, body { height: 100%; }\n    :root, [data-theme=\"dark\"] {\n      --bg: #0e1015; --bg-accent: #13151b; --bg-elevated: #191c24; --bg-hover: #1f2330;\n      --card: #161920; --text: #d4d4d8; --text-strong: #f4f4f5; --muted: #52525b;\n      --border: #1e2028; --border-strong: #2e3040;\n      --accent: #ff5c5c; --accent-hover: #ff7070; --accent-subtle: rgba(255,92,92,0.12);\n      --ok: #22c55e; --warn: #f59e0b; --danger: #ef4444; --info: #3b82f6; --teal: #14b8a6;\n      --radius-sm: 6px; --radius-md: 10px; --radius-lg: 16px;\n      --font-body: -apple-system, BlinkMacSystemFont, \"Segoe UI\", Helvetica, Arial, sans-serif;\n      --mono: \"SFMono-Regular\", Consolas, \"Liberation Mono\", Menlo, monospace;\n      --shadow: 0 1px 3px rgba(0,0,0,0.4);\n    }\n    [data-theme=\"light\"] {\n      --bg: #f5f6fa; --bg-accent: #ffffff; --bg-elevated: #eef0f6; --bg-hover: #e8eaf2;\n      --card: #ffffff; --text: #374151; --text-strong: #111827; --muted: #9ca3af;\n      --border: #e5e7eb; --border-strong: #d1d5db;\n      --accent: #e03131; --accent-hover: #c92a2a; --accent-subtl
...[truncated 28 chars]

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes OrchardOS as a project and task management plugin with a task board, queue runner, REST API, native tools, and web dashboard. This file adds a separate watchdog subsystem that queries gateway health and exposes 'Safe Restart' and 'Snapshot Now' actions against /wdog endpoints, which are host/service lifecycle controls rather than ordinary task-management functionality.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 117)May include surrounding context.

md

Use these directly inside any OpenClaw agent session:

- `orchard_task_add` — add a task to a project
- `orchard_task_list` — list tasks (filter by project_id, status)
- `orchard_task_done` — mark task done with summary
- `orchard_task_block` — mark task blocked with reason

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill advertises agent tools, a REST API, and automatic task dispatch, but the manifest shown does not declare any tool scope or permission boundaries. For an agentic plugin with network/API behavior and persistent state, missing explicit scope increases the risk of over-broad capability exposure and makes security review and safe deployment harder.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description says this is an 'Agentic project and task management plugin' and describes broad capabilities, but it does not define any specific invocation phrases, activation boundaries, or exclusion conditions. For a manifest/markdown-scoped trigger review, this can cause unclear or overly broad skill invocation because there is no explicit guidance on when the skill should or should not be selected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation states that the queue runner dispatches ready tasks as subagents and exposes API/UI endpoints, but it does not clearly warn about the security implications of autonomous execution and externally reachable project-modifying surfaces. Users may enable the plugin without understanding that it can trigger agent actions automatically and accept task-management operations over REST/dashboard interfaces.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Persistent task/project state across sessions can become a security issue when future agents or subagents implicitly trust prior stored instructions, comments, or task content. In an agentic workflow, this creates a durable prompt-injection and unauthorized action propagation channel if untrusted or stale data is later consumed as authoritative context.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

|------|-------------|
| `orchard_project_create` | Create a new project |
| `orchard_project_list` | List all projects |
| `orchard_task_add` | Add a task to a project |
| `orchard_task_list` | List tasks (filter by project, status) |
| `orchard_task_done` | Mark a task done with a summary |
| `orchard_task_block` | Mark a task blocked with a reason |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The brief explicitly instructs the operator to use a real local gateway token in a manual curl test, but provides no warning about secure handling, shell history exposure, log leakage, or use of a least-privilege test credential. In an agent-skill context, documentation that encourages real secret use can normalize unsafe credential handling and lead to token disclosure through copied commands, terminal history, screenshots, or agent outputs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code fetches arbitrary external URLs and incorporates their contents into generated injection text. Although it blocks some private hosts, it still enables attacker-controlled remote content to influence prompts and may permit SSRF-style outbound access to internal-facing hostnames not covered by the simplistic private-host check, especially via DNS rebinding, alternative IP encodings, or redirects.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · src/api/routes.ts (reported line 116)May include surrounding context.

ts

// ── standalone UI proxy server ────────────────────────────────────────────────

function getDashboardHtml(stripLegacyAuth = false): string {
  return stripLegacyAuth ? DASHBOARD_HTML.replace(/const AUTH = '[^']*'/, "const AUTH = ''") : DASHBOARD_HTML;
}

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The comments state that 'Only same-host requests are proxied' and frame the server as a local auth-forwarding proxy, but the implementation only compares the request Origin hostname to the request Host header and then forwards matching-origin requests to whatever host is in gatewayUrl. That does not enforce that proxied traffic stays on the same host as the browser-facing server, so the documentation overstates the restriction actually implemented.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The cleanupSessions action performs irreversible operational changes by deleting subagent sessions and updating task_runs status to failed. In this file there is no confirmation prompt, user-facing warning, or explicit disclosure around that destructive action before it executes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The DELETE /orchard/tasks/:id branch permanently removes a task record once basic checks pass. Although the route validates existence and rejects deletion during active runs, it provides no user-facing warning, confirmation, or disclosure that the operation is destructive.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This route file for a task-management plugin also exposes a configuration-guidance and prompt-injection assembly feature that can pull remote docs and knowledge into an injected prompt. That materially expands the trust boundary and attack surface beyond the stated project/task board purpose, increasing the chance that a caller can influence high-impact configuration-changing agent behavior through this plugin.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The DELETE /orchard/config-safety/:id handler permanently deletes a configuration safety profile. This is a destructive operation, but the code does not include any confirmation step, visible warning, or explanatory disclosure before deletion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The DELETE /orchard/knowledge/:id route permanently removes a knowledge entry after checking for existence. There is no confirmation prompt, warning message, or nearby documentation in this file alerting users that the operation deletes stored knowledge.

Content

No source excerpt is available for this finding.