Security audit

Kanboard

Security checks for vulnerabilities and agentic risk

Overview

This Kanboard skill is purpose-aligned, but it gives an agent broad live project-management authority with weak safeguards for credentials and destructive actions.

Install only if you intend to let the agent operate on a live Kanboard instance. Use HTTPS with a valid certificate, a dedicated least-privilege automation account where possible, avoid broad Application API tokens for routine work, and manually confirm any delete, user-management, role, membership, or bulk operation before it runs.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:49
Finding: Application API Credential Can Be Transmitted over Plaintext HTTP
Content: View full analysis
Remediation: View remediation
&2 return 1 ;; esac curl --fail-with-body --show-error --silent \ --proto '=https' \ --tlsv1.2 \ -X POST \ -u "jsonrpc:$token" \ -H "Content-Type: application/json" \ -d "{\"jsonrpc\":\"2.0\",\"method\":\"$method\",\"id\":1,\"params\":$params}" \ "${KANBOARD_URL}/jsonrpc.php" | jq . ``` - Do not disable TLS certificate validation. - Document that HTTPS with a valid, trusted certificate is mandatory. - Rotate the API token immediately if it may previously have been sent over plaintext HTTP. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:30
Finding: Unrestricted Application API Credential Exceeds Normal Task-Management Privileges
Content: View full analysis
Remediation: View remediation
&2 return 1 ;; esac ``` ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list contains broad phrases such as "create task", "move task", and "add comment" that are likely to match ordinary user requests. That can cause the skill to auto-activate in contexts where the user did not explicitly intend to use Kanboard, increasing the chance of unintended external actions against a live project-management system.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.
md
- KANBOARD_URL # e.g. https://kanboard.example.com - KANBOARD_API_TOKEN # from Settings → API, used as password with user "jsonrpc" requires: - curl - jq ---

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation explicitly recommends use of an Application API token that bypasses permission checks, but it does not pair that guidance with strong warnings about least privilege, scope, or audit implications. In practice, this grants the skill broad authority over Kanboard data and makes mistakes or prompt-triggered actions far more damaging.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill includes irreversible deletion examples for projects and tasks with only a brief inline note and no operational safety procedure. Because this skill is designed to perform live API actions, accidental or mis-scoped invocation could permanently delete business data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation exposes destructive operations like comment or subtask removal without requiring confirmation or warning about irreversible effects. In an agent setting, this lowers safety barriers and can lead to accidental data loss if a broad trigger or ambiguous user request causes execution.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.