Security audit

GSD Orchestrator

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent GSD automation skill, but it gives agents broad headless project-execution power and optional secret injection that should be reviewed before use.

Install only for trusted repositories where you intentionally want an agent to run GSD headless workflows. Prefer `query` and `next` over full `auto`, run on a branch or sandbox, review `.gsd/` and code diffs, verify or pin the `gsd-pi` package, and use short-lived least-privilege secrets in answer files that are never committed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger language is very broad and can cause this skill to activate for generic requests like 'execute project' or 'orchestrate development,' even when the user may not intend to run a subprocess-driven automation tool. In this skill, activation leads to potentially powerful headless execution against local project state, so misrouting can result in unintended command execution, file modifications under .gsd/, and autonomous workflow progression.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill presents subprocess orchestration as routine usage but does not prominently warn that it can autonomously execute workflows and modify on-disk project state. That omission increases the chance that an agent or user invokes it without understanding that commands may create .gsd state, alter files, consume budget, and continue multi-step execution.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The answer injection section explicitly supports supplying secrets that are injected into a child process environment, but it does not warn that those secrets may be exposed to subprocesses, tools, logs, spawned descendants, or persisted indirectly through workflow artifacts. In a headless orchestration context, this is especially dangerous because the subprocess may invoke additional tools or agents with broad file and network access, increasing the risk of credential leakage or misuse.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The document explicitly describes supplying secrets that are injected into a child process environment, but it provides no warning about downstream exposure through spawned subprocesses, debug tooling, crash dumps, inherited environments, or untrusted code executed within the workflow. In an orchestration skill that runs headless development workflows via subprocesses, this materially increases the chance that sensitive credentials are over-broadened in scope and exposed to tools, scripts, or dependencies that do not need them.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation explicitly supports `--answers <path>` for pre-supplying answers and secrets, but provides no warning about secure storage, file permissions, lifecycle management, or leakage risks through logs and process context. In an orchestration skill that runs subprocesses headlessly, this increases the chance that operators will place credentials in plaintext files or mishandle them, leading to credential disclosure or unintended persistence.

Static analysis

No suspicious patterns detected.