fix-plan

• Outcome: Review
• Latest audit: Sep 20, 2026 · 11:49 AM UTC
• Version: 0.15.0

Overview

This skill is mostly a planning-tracker management package, but it also contains broad, under-scoped flows for external sharing, indexing, profile/token use, and persistent hook-style state that users should review before installing.

Install only if you want a powerful tracker-management skill that can edit fix_plan.md/checklist.md, create backups, run bundled scripts, query GitHub, use local Plane/Qdrant profile settings and tokens, and in some workflows share planning documents through .agents/docs/shared/CollabMD and Plane comments. Review or disable the external sync/indexing/comment-posting paths before using it on private or sensitive projects.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (88)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description focuses on performing checklist/fix-plan lifecycle operations such as formatting, syncing, prioritizing, and editing items. This code does not implement those operations; instead, its primary function is enforcement: detecting direct edit attempts on target markdown files and terminating with an error unless certain environment variables are present. While this guard is related to the same domain and supports the broader workflow, it is a materially different purpose from the declared management behaviors and introduces undeclared capabilities around access control and environment-sensitive blocking. Therefore this chunk is a description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a comprehensive plan/checklist management skill that can format, prioritize, add/update/upsert items, sync with GitHub state, manage drafts, and perform model triage and completion-criteria handling. The supplied code does not implement any of those lifecycle-management operations. Instead, it performs a single validation/gating function: for edits to fix_plan.md or checklist.md, it inspects the Completed section and exits with an error if entries are older than the current week, instructing the user to archive first. While this loosely relates to the declared 'move/archive' theme, the actual behavior is much narrower and materially different as a pre-edit blocker rather than a management workflow. Therefore the description does not accurately represent this specific code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a general fix_plan/checklist lifecycle-management skill centered on checklist formatting, priorities, item authoring/updating/upserting, draft promotion, completed-item movement, GitHub sync, issue draft handling, model triage, and completion criteria. The supplied code does not implement those behaviors. Instead, it performs a narrow archival operation on a specific 'Pipeline Execution Log' section: it parses log entries, decides which to retain, writes archived entries to separate files, and mutates the original markdown to replace old entries with an archive pointer. This is a materially different primary purpose and includes undeclared file-archival behavior. While the code touches fix_plan.md/checklist.md, that overlap alone is not enough to match the broad declared functionality.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description is centered on comprehensive fix_plan/checklist lifecycle management. The supplied code instead implements a narrow post-ingest pipeline for newly created markdown artifacts. Its primary behavior is to call an external qdrant-import script with workspace profile settings and index the markdown into Qdrant, which is a significant undeclared capability and resource access. Secondarily, it parses '- [ ]' lines from the artifact and appends non-duplicate items into an existing '## Progress' section of fix_plan.md/checklist.md. It does not implement the described formatting rules, priority handling, marker flipping, upsert semantics beyond exact-line dedupe, moving completed items, GitHub sync, issue draft lifecycle, model triage, or completion-criteria enforcement. Because the actual primary purpose and capabilities differ materially from the declared description, this is a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This is a strong mismatch. The declared description is about managing fix_plan/checklist documents: enforcing schema, markers, priorities, add/update/upsert flows, completion movement, GitHub sync, draft issue lifecycle, and role-based default behaviors. The supplied code does none of that. Instead, it performs read-only retrieval from two resources: workspace-isolated Qdrant collections and local wiki pages, then formats the results into a context header. There is no checklist parsing or mutation, no marker handling ([ ]/[x]/[BLOCKED]), no priority logic, no duplicate-check/upsert against tracker items, no GitHub polling, no issue draft publication/archive/delete flow, and no completion criteria enforcement. The primary purpose, resources accessed, and CLI trigger shape all differ materially from the declared skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a mismatch because the declared description presents a general-purpose fix_plan/checklist lifecycle-management skill with many operations and a default workflow, but the supplied code chunk is specifically a claim/release utility. Its primary behavior is coordination leasing: finding an action line, validating markers, stamping or removing [CLAIMED:...] tags, preventing concurrent writes, rejecting fresh competing claims, allowing stale takeover, and optionally syncing a linked Plane issue to a started state. None of that claim-specific functionality is described in the declared purpose, and most of the declared capabilities are absent from this code chunk. The resource scope is adjacent (same tracker files), but the actual capability and primary purpose differ materially.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The supplied code is specifically a cleanup script. It reads a fix_plan/checklist markdown file, identifies completed items, rebuilds the Completed section, and archives older completed entries into .bak markdown files by month or week. That partially overlaps with the declared 'move'/'archive' aspect, but the declaration presents a much broader lifecycle-management skill with many capabilities and default behaviors that are not present in the code at all. The primary behavior is therefore materially narrower than the declared description. There are no obvious harmful undeclared capabilities beyond file modification and archive writing related to cleanup, but the description significantly overstates the implemented functionality.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a material description-behavior mismatch. The declared purpose presents a comprehensive fix-plan/checklist management skill with many operational behaviors, including modifying plan files, lifecycle transitions, duplication checks, draft promotion, GitHub sync, and role-based default flows. The supplied code does none of that. It only reads a tracker file, identifies completed checkbox items still in active sections and residual sub-bullets missing checkbox markers, then prints findings and exits nonzero on violations. While this overlaps slightly with the declared formatting/move topics, the actual code is only a small detector/linter subset and lacks the described management and synchronization functionality. Therefore the description does not accurately represent what this code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a broad fix_plan/checklist lifecycle management skill centered on editing, normalizing, syncing, and maintaining planning documents. The supplied code instead only scans the workspace and reports candidate items for a 'Fable' replenishment queue. It reads fix_plan.md, plan-drafts, generated docs, and llm-wiki outputs, parses simple frontmatter, and prints findings. There is no implementation of checklist schema fixes, marker rewriting, priority reassignment, item add/update/upsert, move-to-completed behavior, GitHub polling/sync, issue draft publication/archive/deletion, model triage sections, role-profile handling, or completion criteria enforcement. This is a materially different primary purpose, so the description does not accurately represent the code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description is entirely about fix_plan.md/checklist.md lifecycle management, including task formatting, priority tagging, progress/completion movement, GitHub sync, issue draft handling, and triage workflows. The supplied code does none of that. Its primary purpose is a hook integrity checker for hook configuration files and referenced scripts. It reads hooks.json, inspects hook commands, resolves script paths, checks whether scripts exist and are executable, and flags generated hooks. This is a materially different purpose, resource scope, and behavior from the declared skill. The mismatch is strong and unambiguous.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description centers on editing and lifecycle management of fix_plan.md/checklist content: formatting markers/sections, assigning priority, adding/updating/upserting tasks, moving completed items, syncing with GitHub state, issue-draft handling, and model triage. The supplied code does not implement those checklist manipulation workflows. Instead, it performs an audit/diagnostic scan over markdown artifact directories to classify documents as stale, broken-ref, orphan-suspect, etc. It reads markdown files and fix_plan.md, but only to detect stale status and linkage, not to modify checklist structure or manage plan items. This is a materially different primary purpose from the declared skill behavior, so it is a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: There is a strong mismatch between the declared description and the code’s actual function. The description promises a rich fix_plan/checklist management tool covering task markers, priorities, updates/upserts of checklist entries, movement of completed items, GitHub issue/PR sync, issue draft publication/archival, model triage, and completion criteria. The supplied code does none of that. Instead, it operates on arbitrary markdown artifact files by modifying YAML frontmatter fields, copying the files to a shared directory, and verifying the copied result. Although the word 'sync' appears in both, the actual sync is for markdown artifacts and CollabMD metadata, not for fix_plan/checklist state or GitHub workflow lifecycle. This is a materially different primary purpose with several undeclared capabilities, so it should be flagged as a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description covers many fix_plan/checklist lifecycle operations, but it does not mention the claim/release lease-tag mechanism that this code is specifically about. The test suite focuses on stamping [CLAIMED] tags, rejecting conflicting or invalid claims, releasing claims, stale takeover rules, duplicate-action ambiguity, CLI flags, and pushing claim state to Plane. Those are material behaviors and integrations, not merely incidental implementation details. While the general domain (fix_plan management) overlaps, the supplied code chunk's primary purpose is narrower and materially different from the declared capabilities, so this is a description/behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description is focused on fix-plan/checklist lifecycle management and GitHub-related synchronization of planning artifacts. The actual code does not implement or test checklist formatting, priority handling, blocked triage, issue draft workflows, role profiles, completion criteria, or plan-item add/update/upsert logic. Instead, it is a unit test file for a different artifact synchronization utility dealing with Markdown frontmatter and filesystem copying. This is a materially different primary purpose, so the description does not accurately represent the supplied code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This code chunk does not implement or directly manage fix_plan/checklist formatting, lifecycle operations, item updates, syncing, draft publishing, or completion criteria. Instead, its primary purpose is regression/unit testing for workspace profile resolution and credential/config handling. While it references fix_plan.md paths, that is incidental to testing tracker-root detection rather than performing the declared skill behavior. The code also handles token file/env resolution for Plane profiles, which is not represented in the declared description. Therefore the actual behavior is materially different from the declared purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description is about managing fix_plan/checklist content and lifecycle state within markdown trackers. The supplied code does not implement checklist formatting, item add/update/upsert, move-to-completed logic, sync with PR/issue state, issue draft lifecycle, model triage, or completion-criteria enforcement. Instead, its primary purpose is configuration/profile resolution for multi-workspace infrastructure settings. While it does include tracker-root resolution related to fix_plan.md location, that is only a supporting path lookup and not the declared checklist-management behavior. This is a clear description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description focuses on managing fix_plan/checklist documents and their lifecycle operations (formatting markers, progress sections, priority labels, item updates, sync with PR/issues, issue draft management, etc.). The supplied code does not manipulate fix_plan/checklist content or implement those workflows. Instead, it is a test suite for a separate `workspace_profile` module, exercising path matching and config translation behavior across v1/v2 workspace profile schemas. This is a materially different primary purpose and introduces undeclared capabilities around workspace configuration and endpoint selection. Although one tested field references a checklist path (`.agents/fix_plan.md`), that is incidental to profile translation rather than checklist lifecycle management.

Ae1

High

• Category: analysis-evasion

Content

STING item in place — flip its marker or append a one-line progress note — via `update_item.py`, without going around `block-direct-checklist-edit.js` | [update

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Agent Config Directory Access

High

• Category: Agent Snooping

Content

**Recency marker maintenance**: upon completing the full pipeline (through step 5, or through the REPEAT cadence check for the `pm` role profile), stamp/update the "last full pipeline run" marker in the tracker's pinned block with the completion timestamp and the role profile used, so Step 0 of a future invocation can find it. If the tracker has no pinned block, skip this — do not create new tracker structure solely for this marker.

**Register BEFORE execute (HARD STOP)**: before Step 1 (Move) begins — after Step 0's recency check has resolved which steps are actually in scope — `TaskCreate` (or `TodoWrite` if `TaskCreate` is unavailable) must register one task per pipeline step actually being run (Move/Format/Sync/Priority/Flowchart-sync for the full pipeline, fewer for a role-scoped subset or a Step-0-narrowed run — see "Role-based execution" below). A default-invocation `/fix-plan` run is multi-step by definition; "the tracker looks small" is not an exception. If a `TaskCreate` call errors, retry it with the corrected parameters from its own error message before any Move/Sync/Priority/Flowchart Edit proceeds — treating a retry as unnecessary overhead and silently dropping tracking is the exact violation this line prevents. Mirrors `~/.claude/skills/wip/SKILL.md` "Register BEFORE execute".

**Subagent-delegated pipeline runs require artifact verification, not just TaskUpdate trust (HARD STOP)**: when a caller delegates this default pipeline to a subagent (`Agent` spawn) rather than executing it directly, a subagent marking its assigned tasks `TaskUpdate(status: "completed")` is NOT sufficient evidence the corresponding tracker edits actually happened. **No whole-pipeline hand-off**: never hand the whole registered task set to one subagent call as a single "run pm" prompt — dispatch (or check in on) each step individually, and after each reported-done step, independently re-read the tracker yourself (a `git diff`/section-length/marker check against the actual file
...[truncated 25 chars]

• Confidence: 85% confidence
• Finding: The skill references a user-specific path under `~/.claude/skills/wip/SKILL.md`, which normalizes access to agent configuration/private home-directory content outside the project workspace. In multi-tenant or policy-constrained environments, instructions that encourage reading from home-directory agent config can expose sensitive local metadata, custom skills, or operational details unrelated to the user's current task.

Ssd 3

High

• Confidence: 98% confidence
• Finding: This section creates a deliberate path from generated planning artifacts into a shared sync directory and then into an external issue system via comment posting. In context, that is especially dangerous because planning documents can contain architecture details, internal URLs, findings, or sensitive project context, and the skill makes this dissemination mandatory rather than exceptional.

Credential Access

High

• Category: Privilege Escalation

Content

|--------------|--------------|---------------|
| Mechanical execution (deploy, apply, click-ops) | No reasoning leverage | Any session with the required access |
| External-response-gated items | Blocked on third parties, not on thinking | Leave in place with trigger note |
| Environment-gated items (kubeconfig, VPN, host access) | Model tier irrelevant to the blocker | Session on the right machine |
| Single-file trivial edits | Cost exceeds value | Regular session |

## Discovery & Replenishment Procedure

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

|--------------|--------------|---------------|
| Mechanical execution (deploy, apply, click-ops) | No reasoning leverage | Any session with the required access |
| External-response-gated items | Blocked on third parties, not on thinking | Leave in place with trigger note |
| Environment-gated items (kubeconfig, VPN, host access) | Model tier irrelevant to the blocker | Session on the right machine |
| Single-file trivial edits | Cost exceeds value | Regular session |

## Discovery & Replenishment Procedure

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

|--------------|--------------|---------------|
| Mechanical execution (deploy, apply, click-ops) | No reasoning leverage | Any session with the required access |
| External-response-gated items | Blocked on third parties, not on thinking | Leave in place with trigger note |
| Environment-gated items (kubeconfig, VPN, host access) | Model tier irrelevant to the blocker | Session on the right machine |
| Single-file trivial edits | Cost exceeds value | Regular session |

## Discovery & Replenishment Procedure

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence
• Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence
• Finding: The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/test_claim_item.py:24

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/test_cleanup.py:22

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/test_workspace_profile.py:25