Security audit

fix-plan

Security checks across malware telemetry and agentic risk

Overview

This skill mostly matches a checklist-management purpose, but bundled helper scripts create under-disclosed token exposure and Qdrant indexing/query paths that users should review before installing.

Review this skill before installing. It is suitable only if you are comfortable with it editing and archiving fix_plan/checklist files, using gh against your repositories, and carrying bundled helpers that can access Plane/Qdrant configuration. Avoid running workspace_profile.py --json with real Plane credentials unless the token output is fixed or redacted, and disable or remove the Qdrant pre/post ingest helpers if you do not explicitly want markdown artifacts indexed or queried through Qdrant.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The script performs Qdrant indexing and research-artifact ingestion, which materially exceeds the declared scope of a fix-plan/checklist lifecycle skill. This scope expansion increases the attack surface by introducing external data movement and indexing behavior that a user would not reasonably expect from the skill description.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: Launching uvx/fastembed to process markdown and send it to Qdrant introduces a significant external-execution and data-exfiltration capability unrelated to the stated fix-plan purpose. Because the indexed markdown may contain sensitive planning or research content, this can leak internal data to an external service or an unreviewed dependency chain without clear user intent.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The skill directs the agent to archive, remove, and delete tracker content, including harvesting completed items and deleting issue drafts, without an explicit warning or confirmation checkpoint before destructive changes. In an automated agent context, this increases the chance of silent data loss, accidental removal of audit history, or irreversible cleanup of user content.

Missing User Warnings

Low

Confidence: 68% confidence
Finding: The skill instructs polling GitHub issue and PR state through `gh` without clearly warning that repository metadata will be transmitted to an external service. While this is expected for a GitHub-sync feature, lack of a privacy notice can cause unintended disclosure in sensitive repos or mixed-trust environments.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documented behavior explicitly allows detailed completion data to be discarded permanently when `--rag` is omitted, while also stating receiver errors do not block the move. In a workflow handling verification logs, commit references, and session IDs, this can destroy audit evidence and operational context, undermining traceability and incident review; the skill context makes this more dangerous because it is a lifecycle-management tool expected to preserve project state reliably.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The script sends user-provided query text to a configured Qdrant service and retrieves workspace-scoped content without any user-facing notice, consent, or visibility at the call site. In a skill advertised as plan/checklist management, this hidden data flow can expose sensitive project terms or artifact topics to an external or remotely hosted service, especially if qdrant_url is not strictly local.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The script resolves the Plane API token from environment variables and stores it in the returned profile object. When `--json` is used, the entire profile is serialized and printed, which exposes the secret to the terminal, logs, shell history capture, or downstream tooling that consumes stdout. In a workspace-management skill, this is especially dangerous because JSON output is likely intended for automation and may be piped into other systems or recorded.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/test_cleanup.py:22