GSD Orchestrator

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:45 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed GSD automation helper, but it gives a headless subprocess broad authority to change projects, auto-answer prompts, and inject secrets with limited safety guidance.

Install only if you intentionally want GSD to run headless development workflows through a subprocess. Prefer a pinned/local `gsd-pi` install, run it in a restricted project workspace, avoid broad environment credentials, keep any answers file out of version control with restrictive permissions, and use explicit answers or supervised mode rather than relying on auto-confirm defaults.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Global Installation of an External Executable Dependency

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/answer-injection.md:73

Finding

Headless Mode Automatically Confirms Unmatched Prompts

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly supports pre-supplying secrets via an answers file and states that they are injected into the child process environment for autonomous runs, but it does not present strong warnings, consent requirements, or scoping controls. In a subprocess-execution skill, this increases the risk that sensitive credentials are exposed to the invoked tool, inherited by downstream processes, logged, or misused during automated workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger description is broad enough to match many generic project-management or development requests, which can cause this skill to be invoked when the user did not explicitly intend to run a subprocess-based orchestrator. Because the skill launches gsd headless workflows that can create milestones, execute tasks, and alter project state, accidental invocation can lead to unintended command execution and side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document explicitly instructs users to place secrets in a JSON file and states they are injected into child-process environment variables, but it omits key safety guidance about plaintext secret storage, file permissions, lifecycle management, inherited environments, and exposure through subprocesses, crash dumps, or misconfigured tooling. In the context of a headless orchestration skill that automates software workflows, this increases the chance that operators will handle credentials unsafely and leak them during automated runs.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The documented default behavior to auto-confirm prompts and choose the first option enables autonomous execution of potentially sensitive workflow decisions without explicit user approval. In an orchestrator that can run development workflows headlessly via subprocesses, this can cause unintended actions such as destructive commands, risky configuration choices, or unsafe progression past security-relevant prompts.

Content

Scanner excerpt · references/answer-injection.md (reported line 75)May include surrounding context.

md

| Prompt Type | Default Behavior |
|-------------|-----------------|
| Select | Picks first option |
| Confirm | Auto-confirms |
| Input | Empty string |
| Editor | Returns prefill or empty |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/commands.md (reported line 145)May include surrounding context.

undo

Revert last completed unit. Use --force to bypass confirmation.

bash

gsd headless undo

Static analysis

No suspicious patterns detected.