backlog

• Outcome: Review
• Latest audit: Oct 18, 2026 · 6:23 AM UTC
• Version: 0.5.0

Overview

The skill is for backlog tracking, but it can also directly modify a Plane backend through Kubernetes/SSH fallback paths that need careful review.

Install only if you intend this skill to manage a Plane-backed backlog and are comfortable granting it Plane API tokens and, if configured, Kubernetes or SSH access to the Plane backend. Prefer REST-only use, review workspace_profile and token settings, and avoid production kubeconfig access unless the operator explicitly wants backend admin fallback behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (49)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents a broad, unified backlog lifecycle manager spanning triage, priority, sync, prune, lifecycle transitions, comments, creation, and recordkeeping across multiple backlog types and vendor-agnostic trackers. The supplied code does only one narrow subset: it scans fix_plan.md for untracked checkbox items, heuristically classifies them into a small set of hardcoded projects, and creates issues in a specific Plane workspace using a specific API key and endpoint. It also writes Plane links back into fix_plan.md. While issue creation and some triage/priority mapping are loosely related to the declaration, the actual code lacks most of the described lifecycle/sync/prune/comment/record functions and is materially more specific and vendor-bound than advertised. That makes the description inaccurate for this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The description presents a broad, vendor-agnostic backlog management skill spanning multiple backlog types and lifecycle operations. The supplied code is materially narrower: it is a Plane-specific bulk synchronization tool that reads fix_plan.md and updates only priority and target dates on existing Plane issues. While this partially overlaps with the declared topics of priority and sync, the primary behavior is not a unified lifecycle manager and most declared capabilities are absent. The code also accesses a specific external Plane API and modifies issues directly, which is much more specialized than the declared general orchestration role.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description presents a broad, vendor-agnostic backlog lifecycle manager spanning session TODOs, workspace checklists, issue trackers, triage, sync, pruning, commenting, and recordkeeping. The supplied code chunk is much narrower: it is an entity-creation utility for Plane only. Its primary behavior is to create Plane issues or pages, convert markdown into editor/storage formats, and fall back to executing Django-shell code inside a Kubernetes workload via kubectl or SSH. While 'create issue' is one declared topic, the code does not implement most of the declared backlog-management functions, and it introduces significant undeclared infrastructure access behavior (cluster exec into K3s) plus page/wiki creation. This is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description presents a broad backlog-management skill that orchestrates TODOs, checklists, and issue trackers with vendor-agnostic lifecycle contracts. This code chunk instead implements one narrow, vendor-specific function: creating Plane issues/intake issues. It also includes an undeclared operational capability: executing kubectl against a K3s workload and running Django-shell code inside the Plane pod to create issues directly if the REST API fails. While issue creation and priority tagging are mentioned in the description, the primary behavior here is much narrower than the declared scope, and several declared capabilities (triage, sync, prune, lifecycle management, commenting, recording) are absent from this code. Therefore the description does not accurately represent this specific code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description presents a comprehensive, vendor-agnostic backlog management/orchestration skill spanning session TODOs, fix_plan/checklist files, and issue tracker lifecycle workflows. The supplied code instead implements a specific Plane updater script for existing issues/pages. Its concrete behaviors are limited to identifying an issue/page, converting markdown, updating fields through the Plane REST API, and using kubectl/ssh-based Django shell fallback to write directly to the Plane database. While priority updating loosely overlaps the declared 'priority' topic, the script lacks the vast majority of declared functions (triage, sync polling, pruning, commenting, creation, recording, checklist/session TODO handling). The primary purpose is materially narrower and resource-specific (Plane only, not vendor-agnostic backlog orchestration).

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declaration describes a broad backlog-management capability spanning multiple backlog types, lifecycle operations, and tracker interactions. The code chunk instead performs one focused verification task: confirming that a Plane identifier resolves to an existing issue and optionally that its title matches an expected phrase. It is read-oriented and validation-oriented, not orchestration-oriented. It does not manage TODOs, checklists, issue state, comments, creation, syncing, or prioritization. The code also appears Plane-specific rather than vendor-agnostic. This is therefore a strong description-versus-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The code does not implement or orchestrate backlog lifecycle management, task triage, priority tagging, syncing trackers, pruning, issue commenting/creation, or session/file backlog recording. Instead, it contains unit tests focused on PlaneClient methods: browse_url(), issue_url(), and list_projects(). Its primary purpose is validating URL shape and pagination behavior for a Plane API client. That is materially different from the declared backlog-management functionality, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a broad backlog lifecycle management skill covering triage, priority tagging, synchronization with trackers, pruning, lifecycle transitions, comments, issue creation, and recording completed work across multiple backlog surfaces. The supplied code chunk does not implement or orchestrate those behaviors. It is a narrow unit test module for Plane issue creation, specifically validating browse_url generation/printing and behavior under mocked REST and fallback paths. While issue creation is mentioned in the description, this code is only a low-level test of URL formatting for one tracker integration and does not reflect the declared primary purpose or most listed capabilities. Therefore the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a broad backlog lifecycle management capability spanning triage, priority tagging, sync, pruning, state transitions, commenting, issue creation, and work recording. The supplied code chunk instead contains only unit tests for a helper script that verifies Plane issue identifiers and expected titles. Its primary function is test coverage for parsing and resolution logic, using a fake client and checking exit codes. This is materially different from the declared purpose and omits nearly all claimed backlog-management capabilities.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · comment.md (reported line 22)May include surrounding context.

for d in "${BACKLOG_SCRIPTS:-}"
"${CLAUDE_PLUGIN_ROOT:-}/skills/backlog/scripts"
"${AGENT_SKILLS_HOME:-$HOME/.agents}/skills/backlog/scripts"
"${GEMINI_SKILLS_HOME:-$HOME/.gemini/config}/skills/backlog/scripts"; do [ -n "$d" ] && [ -d "$d" ] && BACKLOG_SCRIPTS="$d" && break done

text

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · create.md (reported line 32)May include surrounding context.

for d in "${BACKLOG_SCRIPTS:-}"
"${CLAUDE_PLUGIN_ROOT:-}/skills/backlog/scripts"
"${AGENT_SKILLS_HOME:-$HOME/.agents}/skills/backlog/scripts"
"${GEMINI_SKILLS_HOME:-$HOME/.gemini/config}/skills/backlog/scripts"; do [ -n "$d" ] && [ -d "$d" ] && BACKLOG_SCRIPTS="$d" && break done

text

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The file has undeclared shell-capable behavior through subprocess, kubectl, and SSH execution, which means the skill can perform actions beyond what its declared permissions apparently communicate. Permission mismatches are dangerous because users and policy engines may authorize the skill under false assumptions about its operational reach.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/plane_client.py (reported line 158)May include surrounding context.

python

- --type page: Page (wiki-style doc) creation, K3s Django-shell only (no REST
    attempt — that endpoint's behavior on this workspace hasn't been verified)

K3s fallback target (namespace/kubeconfig) comes from the resolved workspace
profile (workspace_profile.py's k3s_namespace/k3s_kubeconfig, propagated by
plane_client.resolve_profile) — set these per-workspace rather than assuming
a single kubectl context. Getting this wrong silently creates the

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/plane_create_entity.py (reported line 13)May include surrounding context.

python

- --type page: Page (wiki-style doc) creation, K3s Django-shell only (no REST
    attempt — that endpoint's behavior on this workspace hasn't been verified)

K3s fallback target (namespace/kubeconfig) comes from the resolved workspace
profile (workspace_profile.py's k3s_namespace/k3s_kubeconfig, propagated by
plane_client.resolve_profile) — set these per-workspace rather than assuming
a single kubectl context. Getting this wrong silently creates the

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/plane_create_entity.py (reported line 14)May include surrounding context.

python

- --type page: Page (wiki-style doc) creation, K3s Django-shell only (no REST
    attempt — that endpoint's behavior on this workspace hasn't been verified)

K3s fallback target (namespace/kubeconfig) comes from the resolved workspace
profile (workspace_profile.py's k3s_namespace/k3s_kubeconfig, propagated by
plane_client.resolve_profile) — set these per-workspace rather than assuming
a single kubectl context. Getting this wrong silently creates the

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/plane_create_entity.py (reported line 604)May include surrounding context.

python

- --type page: Page (wiki-style doc) creation, K3s Django-shell only (no REST
    attempt — that endpoint's behavior on this workspace hasn't been verified)

K3s fallback target (namespace/kubeconfig) comes from the resolved workspace
profile (workspace_profile.py's k3s_namespace/k3s_kubeconfig, propagated by
plane_client.resolve_profile) — set these per-workspace rather than assuming
a single kubectl context. Getting this wrong silently creates the

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/plane_create_entity.py (reported line 606)May include surrounding context.

python

- --type page: Page (wiki-style doc) creation, K3s Django-shell only (no REST
    attempt — that endpoint's behavior on this workspace hasn't been verified)

K3s fallback target (namespace/kubeconfig) comes from the resolved workspace
profile (workspace_profile.py's k3s_namespace/k3s_kubeconfig, propagated by
plane_client.resolve_profile) — set these per-workspace rather than assuming
a single kubectl context. Getting this wrong silently creates the

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/plane_create_entity.py (reported line 607)May include surrounding context.

python

- --type page: Page (wiki-style doc) creation, K3s Django-shell only (no REST
    attempt — that endpoint's behavior on this workspace hasn't been verified)

K3s fallback target (namespace/kubeconfig) comes from the resolved workspace
profile (workspace_profile.py's k3s_namespace/k3s_kubeconfig, propagated by
plane_client.resolve_profile) — set these per-workspace rather than assuming
a single kubectl context. Getting this wrong silently creates the

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/plane_update_entity.py (reported line 214)May include surrounding context.

python

- --type page: Page (wiki-style doc) creation, K3s Django-shell only (no REST
    attempt — that endpoint's behavior on this workspace hasn't been verified)

K3s fallback target (namespace/kubeconfig) comes from the resolved workspace
profile (workspace_profile.py's k3s_namespace/k3s_kubeconfig, propagated by
plane_client.resolve_profile) — set these per-workspace rather than assuming
a single kubectl context. Getting this wrong silently creates the

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/plane_update_entity.py (reported line 236)May include surrounding context.

python

- --type page: Page (wiki-style doc) creation, K3s Django-shell only (no REST
    attempt — that endpoint's behavior on this workspace hasn't been verified)

K3s fallback target (namespace/kubeconfig) comes from the resolved workspace
profile (workspace_profile.py's k3s_namespace/k3s_kubeconfig, propagated by
plane_client.resolve_profile) — set these per-workspace rather than assuming
a single kubectl context. Getting this wrong silently creates the

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/plane_update_entity.py (reported line 237)May include surrounding context.

python

- --type page: Page (wiki-style doc) creation, K3s Django-shell only (no REST
    attempt — that endpoint's behavior on this workspace hasn't been verified)

K3s fallback target (namespace/kubeconfig) comes from the resolved workspace
profile (workspace_profile.py's k3s_namespace/k3s_kubeconfig, propagated by
plane_client.resolve_profile) — set these per-workspace rather than assuming
a single kubectl context. Getting this wrong silently creates the

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The code executes base64-decoded Python via exec inside a Django shell in the Kubernetes workload. Even if used to transport generated code safely, this obscures behavior from reviewers and defenders and creates a powerful code-execution primitive that can be repurposed for arbitrary backend actions.

Content

Scanner excerpt · scripts/plane_create_entity.py (reported line 611)May include surrounding context.

python

cmd += [
        "exec", "-n", namespace, "deploy/plane-api-wl", "--",
        "python3", "manage.py", "shell", "-c",
        f"import base64; exec(base64.b64decode('{b64_script}').decode('utf-8'))"
    ]
    try:
        res = subprocess.run(cmd, capture_output=True, text=True, check=True)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill can execute privileged Django shell commands inside a Kubernetes workload and over SSH, which far exceeds normal backlog/task-tracking needs and grants broad backend control over the Plane instance. In this context, the excess capability is especially risky because a backlog skill is likely to be invoked frequently and trusted for routine administrative work, increasing the chance of unnoticed misuse.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/test_plane_client_browse_url.py:25

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/test_plane_client_intake.py:22

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/test_plane_create_issue_browse_url.py:27

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/test_plane_priority_mapping.py:28

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/test_plane_sync.py:21

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/test_plane_verify_identifier.py:21