Workspace Planning

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:34 AM UTC
• Version: 0.3.0

Overview

The skill fits project schedule management, but it needs review because it can auto-install an unpinned package into a persistent home-directory environment and can follow schedule file references outside the intended schedule folder.

Review before installing. Use it only in workspaces where schedule YAML is trusted, avoid untrusted module_files entries, and prefer preinstalling a pinned PyYAML dependency instead of allowing automatic bootstrap. Confirm any Yunxiao sync carefully because it creates business work items and writes returned IDs into YAML.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/planning.py:18
• Finding: Automatic Installation of an Unpinned Runtime Dependency## Vulnerability Details **File Location**: `scripts/planning.py`, lines 18-33 **Vulnerability Type**: Unpinned dependency installation and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```python def _bootstrap_venv() -> None: """Create a venv with PyYAML (if needed) and re-exec using the venv's python.""" python = str(VENV_DIR / "bin" / "python") if not (VENV_DIR / "bin" / "python").exists(): print(f"PyYAML not found. Bootstrapping venv at {VENV_DIR}...", file=sys.stderr) VENV_DIR.parent.mkdir(parents=True, exist_ok=True) venv.create(str(VENV_DIR), with_pip=True) pip = str(VENV_DIR / "bin" / "pip") subprocess.check_call( [pip, "install", "--quiet", "pyyaml"], stdout=sys.stderr, stderr=sys.stderr, ) print("Done.", file=sys.stderr) os.execv(python, [python, *sys.argv]) ``` ### Technical Analysis If PyYAML cannot be imported, the script automatically creates a persistent virtual environment and runs `pip install pyyaml`. The dependency has no exact version constraint or cryptographic hash, and no controlled package index is specified. Consequently, the code installed at runtime is not necessarily the same code that was evaluated during this audit. Package-index state and the latest eligible PyYAML release may change after publication of the Skill. Installation can also run package build or installation logic with the privileges of the user invoking the Skill. The documentation states that PyYAML is required, but it does not clearly disclose that the script will automatically download and install the package before re-executing itself. ### Attack Path 1. The Skill is invoked in an environment where `import yaml` fails. 2. `_bootstrap_venv()` creates a virtual environment under the user's home directory. 3. The script contacts the package source configured for `pip`. 4. `pip ...[truncated 935 chars]
• Remediation: ## Remediation Suggestions 1. Remove automatic dependency installation from normal command execution. 2. Declare dependencies through a lock file or packaging metadata and require an explicit setup step. 3. Pin PyYAML to an audited exact version rather than installing an unconstrained latest release. 4. Use cryptographic hashes, such as `pip install --require-hashes`, to verify downloaded artifacts. 5. Use a trusted, controlled package index and disable untrusted supplemental indexes. 6. If bootstrap behavior must remain, obtain explicit user confirmation and clearly disclose the network access and installation destination. 7. Treat the cached environment as mutable state and provide a documented mechanism to verify, update, or remove it securely.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/planning.py:75
• Finding: Path Traversal Through Unrestricted module_files References## Vulnerability Details **File Location**: `scripts/planning.py`, lines 75-93 **Vulnerability Type**: Unrestricted external file reference and path traversal **Risk Level**: Medium ### Vulnerable Code ```python if "module_files" in data: all_modules: list[dict] = [] for ref in data["module_files"]: ref_path = path.parent / ref if not ref_path.exists(): print( f"Error: referenced module file '{ref}' not found at {ref_path}", file=sys.stderr, ) sys.exit(1) with open(ref_path) as f: ref_data = yaml.safe_load(f) for m in ref_data.get("modules", []): m["_source_file"] = str(ref_path) all_modules.append(m) data["modules"] = all_modules ``` ### Technical Analysis Values in the schedule's `module_files` list are directly joined with the main schedule directory. The code does not reject absolute paths, normalize traversal components, call `Path.resolve()`, or verify that the resolved target remains under the intended schedule directory. A value such as `../../external.yaml` can therefore reference a YAML file outside `planning/schedules`. An absolute path can have a similar effect because Python path composition permits the absolute component to replace the preceding base path. The loaded path is assigned to `_source_file`. The `update` and `link` commands subsequently expose that value as `source_file` in their JSON output. `SKILL.md` instructs the Agent to use this returned path with an editing tool. Although the Python script itself only validates and reads files, the documented multi-step workflow can turn the unrestricted read into an unauthorized write. Safe YAML parsing prevents arbitrary YAML object construction, but it does not prevent unauthorized file access or path traversal. ### Attack Path 1. An attacker supplies or modifies a main schedule YAML ...[truncated 1537 chars]
• Remediation: ## Remediation Suggestions 1. Resolve the main schedule directory and each referenced path before opening it: ```python base_dir = path.resolve().parent if Path(ref).is_absolute(): raise ValueError("Absolute module file paths are not allowed") ref_path = (base_dir / ref).resolve() try: ref_path.relative_to(base_dir) except ValueError: raise ValueError("Module file must remain inside the schedule directory") ``` 2. Reject absolute paths, `..` traversal, symbolic-link escapes, and non-file targets. 3. Require referenced files to have an approved extension and reside beneath the resolved schedule directory. 4. Validate that `module_files` is a list of strings before performing path operations. 5. Before an Agent edits a returned `source_file`, independently verify that the resolved path remains within the approved workspace and schedule directory. 6. Avoid treating paths derived from untrusted YAML as authorization to modify a file. 7. Add tests covering relative traversal, absolute paths, symbolic links, malformed path values, and legitimate nested schedule files.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

stderr=sys.stderr,
        )
        print("Done.", file=sys.stderr)
    os.execv(python, [python, *sys.argv])


try:

• Confidence: 85% confidence
• Finding: os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs the agent to execute shell commands via `python3 <skill-dir>/scripts/planning.py ...`, but it does not declare any explicit tool scope such as `permissions` or `allowed-tools`. That mismatch weakens least-privilege enforcement and can allow an agent runtime to grant broader execution capability than reviewers or platform controls expect.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes broad natural-language phrases such as `progress`, `milestone`, `what's left`, and `mark as done`, which can cause the skill to activate in unrelated conversations. Unintended invocation is risky here because the skill can drive shell-backed review/update flows and potentially modify YAML schedule data if the agent proceeds with update actions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill includes environment bootstrapping and package installation logic unrelated to deterministic YAML schedule operations, expanding its capabilities into arbitrary dependency installation and execution. In a skill context, hidden side-effectful setup is more dangerous because simply invoking the tool can trigger networked package retrieval and execution beyond user expectations.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

VENV_DIR.parent.mkdir(parents=True, exist_ok=True)
        venv.create(str(VENV_DIR), with_pip=True)
        pip = str(VENV_DIR / "bin" / "pip")
        subprocess.check_call(
            [pip, "install", "--quiet", "pyyaml"],
            stdout=sys.stderr,
            stderr=sys.stderr,

• Confidence: 89% confidence
• Finding: This code automatically invokes pip to install PyYAML at runtime, which causes the skill to perform package-management actions and execute installer code outside its stated schedule-management purpose. If an attacker can influence package index configuration, network path, or local pip settings, this becomes a supply-chain execution surface that runs during normal use.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: This markdown file includes multiple example values and labels in Chinese, such as display names, milestone titles, notes, and API descriptions, while presenting itself as a general schema reference. Because the document does not state that the schema is intended only for a Chinese-language context or offer language/locale flexibility, it may conflict with an organizational policy against forcing a specific language without user opt-in.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The CLI silently bootstraps a virtualenv and installs a package with only a status message, so users may trigger code download and execution without meaningful prior consent. While this is not an exploit by itself, it weakens trust boundaries and increases the chance of unintended package execution in environments where skills are expected to be narrowly scoped and predictable.

Static analysis

No suspicious patterns detected.