activity-duration-estimation

• Outcome: Review
• Latest audit: Jun 25, 2026 · 10:24 AM UTC
• Version: 1.11.7

Overview

This looks like a legitimate project-management skill, but it exposes broad local database access and an unauthenticated settings server that are not safely scoped for a low-permission package.

Install only if you are comfortable with a broad project-management helper that stores project data locally and can be directed to read/import/export SQLite knowledge bases. Do not run the settings server on an untrusted network, and treat generated economic/EVM HTML reports as network-loading pages because they fetch Chart.js from a CDN.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares low sensitivity and no meaningful permissions, yet the content explicitly describes capabilities consistent with file read/write, environment use, persistent databases, and external-path storage. This is dangerous because operators and policy engines may grant the skill more trust than warranted, creating a hidden capability gap that can enable unauthorized data access or persistence without informed approval.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented behavior goes beyond project estimation into arbitrary knowledge-base ingestion, direct external SQLite connectivity, database export/copy, and an HTTP settings server that accepts configuration changes. That expansion materially increases the attack surface: arbitrary external DB access and writable configuration/UI endpoints can expose sensitive data, permit unsafe state changes, or be repurposed outside the stated analytical scope.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The FAQ says the skill may infer O/M/P values through semantic analysis and, if the model lacks knowledge, guide or perform search to obtain supporting information. That expands the operational scope beyond a purely local estimation tool and can cause the agent to access external information sources or make autonomous assumptions about project parameters without explicit user consent, increasing privacy, reliability, and control risks.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The FAQ explicitly allows the executing AI to choose any available search tool, with no fixed boundary on which connector or external service may be used. This broadens capability beyond the stated skill description and creates an uncontrolled data egress path where project details could be sent to arbitrary search systems, undermining least privilege and user expectations.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The document explicitly adds external search, URL fetching, and knowledge-base lookup behavior that expands the skill beyond its stated local project-estimation and reporting scope. This increases attack surface for prompt injection, untrusted content ingestion, and unintended data exfiltration or policy bypass if the agent is allowed to browse based on user or model judgment.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill documents the ability to fetch arbitrary URLs and search public sources without clearly tying that capability to a narrowly bounded business need. In agent systems, undocumented or weakly justified retrieval features are dangerous because they can be abused to pull malicious instructions from external content or to access data sources users did not expect this skill to contact.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The function exposes arbitrary SQLite file access and returns a live connection object, explicitly enabling caller-controlled SQL execution against any filesystem-reachable database. In an agent skill context, this creates a dangerous capability expansion that can be used to read sensitive local data, modify external databases, or pivot into further abuse through attached databases and SQLite features.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This import path accepts arbitrary database paths, arbitrary table names, and caller-controlled column mappings, then copies the selected data into the skill database. Even though it is not classic SQL injection on values, it still grants broad unauthorized data-ingestion capability and uses unsafely interpolated identifiers in SQL, enabling exfiltration from local SQLite files and potential query manipulation if an attacker controls table or column names.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The export function copies the entire knowledge database to an arbitrary filesystem path provided by the caller. In an agent environment, this can be abused to exfiltrate accumulated project and knowledge data or to write sensitive content into unintended locations if the process has sufficient filesystem permissions.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The file starts an HTTP server on 0.0.0.0 and exposes configuration load/save/reset functionality without any authentication or authorization checks. Even if intended for local settings management, this creates an administrative surface unrelated to the core estimation/analysis function and can allow any reachable client on the network to read or modify persistent skill settings.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The server sends Access-Control-Allow-Origin: * on all responses, including /api/save and /api/reset, while accepting unauthenticated POST requests that persist configuration changes. This enables cross-origin requests from arbitrary websites to trigger configuration modification from a victim's browser if the service is reachable, turning the local settings panel into a CSRF-like remote configuration channel.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The template loads Chart.js from a public CDN at render time, which creates an unnecessary external dependency for a report-generation artifact that is described as local and self-contained. This introduces supply-chain and privacy risks: a compromised CDN response, blocked network, or outbound request leakage can alter report behavior or expose metadata about report viewing.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill metadata says the output is a self-contained HTML report, but this template depends on an externally hosted script. That mismatch is security-relevant because users may open the report expecting an offline/local artifact, while it silently performs a third-party fetch that can fail, leak information, or execute untrusted updated code.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The template imports Chart.js from a third-party CDN at render time, which creates unintended network dependency and a supply-chain/privacy risk for a report that is supposed to be locally generated. If the CDN is unavailable, blocked, or compromised, the report may fail to render correctly or execute attacker-controlled JavaScript in the viewer's browser.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill claims to generate self-contained HTML reports, but this template depends on an external CDN-hosted script, so the report is not actually self-contained. This mismatch is security-relevant because users may open the file assuming it is offline-safe, while it in fact triggers external requests and inherits the associated integrity, privacy, and availability risks.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The settings UI exposes an automatic 'web search' capability that is not declared in the skill metadata, creating a capability/expectation mismatch. Undeclared outbound network behavior can surprise users and reviewers, and may enable unintended data egress or retrieval of untrusted external content during execution.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The UI advertises automatic knowledge-base collection and querying, but this capability is not disclosed in the skill description. Hidden or undocumented persistence and retrieval features can lead to sensitive project data being stored, reused, or surfaced unexpectedly, which is a security and privacy risk.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger list is a long, unconstrained set of broad project-management and financial-analysis keywords that can cause the skill to activate in many loosely related contexts. This increases the chance of unintended invocation, causing the agent to apply the skill to irrelevant user requests, expose internal data paths or generated reports in the wrong workflow, and override more appropriate safety or domain-specific handling.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The FAQ describes automatic use of search tools but does not warn users that project descriptions, task names, estimates, or related metadata might be transmitted to external systems. In a project-planning skill, those inputs may contain sensitive business information, so silent external querying creates meaningful confidentiality and compliance risk.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The document allows knowledge-base reads when the 'LLM judges historical data is needed,' which gives the model broad discretionary authority to access stored data without a user-scoped, explicit trigger. In a skill that can query historical projects and benchmarks, this can lead to over-collection or inappropriate retrieval of sensitive prior project information, especially if prompts indirectly steer the model into consulting the knowledge base.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The interface exposes persistent write, import/export, and external database connection capabilities but does not clearly warn that these actions may access, copy, or permanently store user data. In practice, this weakens informed consent and increases the risk of unintended data retention, exfiltration through export, or unsafe access to external databases when the user may believe the operation is transient.

Static analysis

No suspicious patterns detected.