Security audit

PMO

Security checks for vulnerabilities and agentic risk

Overview

This PMO skill fits its project-management purpose, but users should review it because it under-discloses local data retention and can automatically send project/risk summaries to external channels.

Review before installing. Use least-privilege GitHub tokens, prefer environment variables over command-line tokens, treat memory/PMO files as containing internal project metadata, and only enable Telegram/Feishu or similar alert channels after confirming recipients and payload sensitivity.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documents environment-variable access for credentials and network-backed integration behavior, but no explicit permission declaration is present. That creates a trust and governance gap: the agent may access secrets or external services without clear user/admin approval, which is dangerous in a skill that auto-triggers on broad PMO-related phrases.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The manifest states the skill does not store project data and only caches events and risks, yet the design persists a project registry and appends new project metadata to projects.yaml. This is a data-handling deception risk: operators and users may authorize the skill under a false assumption about what is retained locally.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The 'read/analyze/alert only' framing conflicts with later handlers that write to projects.yaml, events.jsonl, risks.yaml, and cache files. In a security review, this matters because understated write behavior can bypass policy expectations around retention, auditing, and data minimization.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill accesses credentials via environment variables and transmits project data to external services, yet it provides no explicit user-facing disclosure or consent flow around credential use and outbound data access. In an auto-triggering skill, this can surprise users and cause unauthorized data exposure or policy violations.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Automatic weekly reports and risk alerts can send project information to Telegram/Feishu or other channels without an explicit confirmation step or disclosure. Because PMO content may include sensitive project status, blockers, and cross-project risks, automatic outbound notifications increase the chance of unintentional leakage to broad audiences.

Static analysis

No suspicious patterns detected.