ClawHub
Back to skill

Security audit

task-plan-generator_cn

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed task-planning helper, but users should be aware that it reads planning-resource files and stores task reports in the workspace.

Install only if you are comfortable with the agent reading plan_source.md from the documented locations and writing compact task reports under task_reports/. Keep sensitive paths, API endpoints, credentials, and private project details out of plan_source.md and archived reports unless you intentionally want them reused for planning.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:47
Finding

Unrestricted Resource Discovery Outside the Active Workspace

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47–53
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Complete Code Snippet

markdown
### 读取 plan_source.md

在当前工作空间或指定路径查找 `plan_source.md` 文件：

```text
查找路径优先级：
1. 当前工作空间根目录/plan_source.md
2. 上一级目录/plan_source.md
3. ~/.claude/resources/plan_source.md
text

The resource format may include sensitive environmental metadata:

```markdown
## 可用系统资源
- 当前工作目录路径
- 可访问的API端点

Technical Analysis

The Skill explicitly directs the Agent to search for planning resources outside the active workspace. Its fallback locations include the workspace's parent directory and the Agent's home configuration directory at ~/.claude/resources/.

This behavior violates least-privilege principles because ordinary task planning does not inherently require access to files belonging to neighboring projects or Agent-level configuration. The instructions do not require explicit user consent, constrain resolved paths to an approved boundary, validate ownership, or filter sensitive content before loading it into the Agent context.

The expected resource format can contain working-directory paths and accessible API endpoints. Consequently, loading an out-of-scope plan_source.md can reveal operational metadata or allow instructions and resource descriptions controlled by another project or user to influence tool selection. No credential theft, network exfiltration, or code execution is explicitly instructed, so the finding is limited to unauthorized cross-boundary discovery and ingestion.

Attack Path

  1. An attacker or another project places a crafted plan_source.md in the active workspace's parent directory or the shared Agent resource directory.
  2. A user invokes the Skill for a routine complex task.
  3. The Agent fails to find plan_source.md in the active workspace and follows the documented fallba ...[truncated 1185 chars]
Remediation
View remediation

Remediation Suggestions

  1. Restrict automatic discovery to {workspace}/plan_source.md.
  2. Require explicit, informed user approval before accessing a parent directory, home directory, or any path outside the active workspace.
  3. Resolve paths canonically and verify that they remain beneath an allowlisted workspace root before reading them.
  4. Reject symbolic links that resolve outside the approved root unless the user specifically authorizes the resolved destination.
  5. Remove API endpoints, credentials, tokens, and other sensitive operational details from plan_source.md; store only non-sensitive resource identifiers.
  6. Treat externally sourced resource descriptions as untrusted data rather than executable instructions.
  7. Record the exact external path to be accessed and present it to the user before requesting approval.
  8. Apply content filtering and size limits when loading resource files to reduce unintended disclosure and contextual influence.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly says it will archive execution results after every task and read historical workspace resources, but it does not require user consent, data minimization, or any privacy warning. This can cause sensitive task content, file paths, tool usage, or business context to be persistently stored and later re-read from the workspace without the user clearly understanding that retention is happening.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest description is written entirely in Chinese and does not indicate that the skill can operate in the user's preferred language. This creates a language-policy concern because it implicitly fixes the skill's user-facing behavior to one language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The archival rules instruct the agent to automatically write reports to workspace files and delete records older than 90 days, but they do not require a warning or confirmation before file writes and deletions occur. In practice, this can lead to unexpected modification of the user's filesystem, loss of historical records, and persistence of potentially sensitive execution metadata.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.