Inbox to Action Closer

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:37 AM UTC
• Version: 1.1.0

Overview

The skill’s core behavior is coherent and draft-only, but the package includes unrelated agent-control instructions and weaker Markdown sanitization that warrant review before installation.

Review this package before installing. The core skill is useful if you want a local, draft-only action board from data you provide, but do not let repository guidance files override your agent’s normal policies, and do not run Saturnday commands or install hooks unless you separately trust that tool. Prefer the structured JSON output or sanitize rendered Markdown before sharing it, and update the development dependencies before running tests or dev servers.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: CLAUDE.md:1

Finding

Repository Instructions Hijack Agent Tooling, Workflow, and Output

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/render.ts:33

Finding

Untrusted Work-Item Fields Are Rendered as Active Markdown Without Adequate Sanitization

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Known Vulnerable Dependency: vitest==3.2.4 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vitest==3.2.4 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The file indicates use of vitest 3.2.4, which is flagged with critical issues including arbitrary file read and possible execution when the Vitest UI server is exposed, plus path traversal via mocker redirect behavior. Even though this is a devDependency, exploitation in developer workstations or CI runners could expose secrets, source code, or enable code execution in trusted build environments.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description presents a broad orchestration skill whose primary function is to combine and prioritize work items from multiple sources into a unified action board. The actual code chunk does not implement that behavior; it is a unit test file for a Trello normalizer. Its scope is narrow and limited to validating Trello field mapping and logging behavior. While Trello normalization could be a supporting component of the declared skill, this specific chunk materially differs from the declared primary purpose and lacks the described multi-source orchestration, deduplication, prioritization, and rendering capabilities. Therefore this chunk does not accurately represent the declared skill behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This code chunk does not implement the declared orchestration behavior at all. It is purely a unit/integration test for repository setup and dependency configuration. While reading a local package.json is not inherently dangerous, it is materially unrelated to the claimed purpose of processing work-item data and producing a merged prioritized action board. Therefore, the description does not accurately represent the supplied code chunk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

3. Pass all normalised items through `dedupe` (src/dedupe.ts) to merge cross-source duplicates using conservative confidence-based matching.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.8 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==7.3.1 — 5 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-39363 (Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket) +2 more

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

md

## Non-goals

- Auto-sending replies or write-backs without confirmation.
- Replacing dedicated project management tools.
- ML-based classification.
- API connectors or credential management — bring your own data or use upstream tools.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/normalize-github.test.ts (reported line 59)May include surrounding context.

ts

created_at: '2024-01-15T10:00:00Z',
    updated_at: '2024-01-16T12:00:00Z',
    user: { login: 'charlie' },
    pull_request: { url: 'https://api.github.com/repos/acme/app/pulls/101' },
    requested_reviewers: [{ login: 'dave' }],
    repository: { full_name: 'acme/app' },
    ...overrides,

Known Vulnerable Dependency: @vitest/mocker==3.2.4 — 1 advisory(ies): CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: esbuild==0.27.4 — 1 advisory(ies): GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json

"test:watch": "vitest"
  },
  "devDependencies": {
    "tsx": "^4",
    "typescript": "^5",
    "vitest": "^3"
  },

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json

},
  "devDependencies": {
    "tsx": "^4",
    "typescript": "^5",
    "vitest": "^3"
  },
  "license": "MIT"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 78% confidence

Finding

Using an unpinned vitest dependency is more dangerous here because the resolved version is identified as 3.2.4 with critical advisories. While the issue originates from the vulnerable package rather than the caret range itself, allowing flexible resolution increases the chance of pulling an unsafe version in developer or CI environments.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json

"devDependencies": {
    "tsx": "^4",
    "typescript": "^5",
    "vitest": "^3"
  },
  "license": "MIT"
}

Static analysis

No suspicious patterns detected.