Security audit

Pm Master

Security checks across malware telemetry and agentic risk

Overview

This PM planning skill is coherent, but it sends project material to an external MCP service using a hard-coded shared token, so it needs review before installation.

Install only if you trust the publisher and the operator of https://mcp.smartmoves.com.cn/pm/mcp with confidential project materials. The published bearer token should be revoked and replaced with user-provided credentials, and users should get an explicit notice before sending requirements, architecture documents, staffing, cost, or schedule data to the remote service.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares no explicit permissions, yet its instructions require capabilities equivalent to file access and remote/tool invocation. This undermines least-privilege expectations and can cause an agent or reviewer to underestimate what the skill can actually do, increasing the chance of unintended data access or command execution through the connected tool layer.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The manifest presents a project-management planning assistant, but the actual behavior includes generic authenticated remote tool invocation with arbitrary tool names, messages, context, and conversation IDs. That mismatch is dangerous because users may provide sensitive project material under the assumption of local PM assistance, while the skill can route data and actions through a broader remote execution surface.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The file embeds a live bearer token directly in skill documentation. Hard-coded credentials can be harvested by anyone with repository or package access and then reused to access the remote MCP service, potentially exposing project data, enabling unauthorized tool use, and creating a durable supply-chain secret leak.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill is described as a PM planning assistant, but in practice it depends on a remote MCP service that performs workspace and document operations. This hidden operational dependency expands the trust boundary and can expose sensitive planning documents or internal paths to external infrastructure without clear user understanding.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: Greeting-based activation on generic phrases like 'hi' or '你好' is overly broad and can trigger the skill during normal conversation without clear user intent. In this skill's context, accidental activation is more dangerous because it can lead to remote MCP connection and subsequent handling of project data or tool-driven workflows unintentionally.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: Trigger rules based on 'or semantically similar phrasing' are ambiguous and make it hard to distinguish normal PM discussion from an intentional request to run a tool workflow. This ambiguity increases the chance of unintended remote processing and data disclosure, especially because the skill chains into external MCP-backed operations.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The keyword trigger table includes broad terms such as project planning, iteration plan, or workload assessment that may appear in ordinary discussion. Because these keywords can launch workflows tied to remote tools, collisions with routine conversation can produce unauthorized or unintended actions and external data transmission.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill instructs the agent to connect to an external MCP endpoint but does not warn that project requirements, architecture documents, plans, and other sensitive content may be transmitted off-system. In a PM skill, those materials commonly contain confidential business, technical, and staffing information, so silent exfiltration to a remote service materially raises privacy and confidentiality risk.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:94