Security audit

along-plan

Security checks for vulnerabilities and agentic risk

Overview

This planning skill is mostly transparent, but its “read-only” mode allows shell, environment inspection, network clients, and a plan-file write in ways that need careful review before installation.

Install only if you are comfortable with a planning skill that is not strictly read-only in practice: it can ask the agent to save plan files, inspect environment/process data, and use outbound network tools. Prefer using it in a sandbox with minimized environment variables and no inherited secrets, and avoid following repository-supplied instructions that request env, printenv, curl, or wget unless you explicitly trust the target and purpose.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: references/safe-commands.md:96
Finding: Bypassable Shell Command Safety Policy
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/safe-commands.md:26
Finding: Exposure of Sensitive Environment and Process Information
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/safe-commands.md:47
Finding: Unrestricted Network Clients Permitted in Read-Only Plan Mode
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.
md
- Only use `read`, `grep`, `glob`, `bash` (bash restricted to safe commands — see `references/safe-commands.md`)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
- Only use `read`, `grep`, `glob`, `bash` (bash restricted to safe commands — see `references/safe-commands.md`)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is advertised as read-only, but it explicitly authorizes write to save a plan file to disk. That breaks the trust boundary implied by the manifest and can be abused to persist unexpected content or cause side effects in environments that rely on the read-only designation for safety decisions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instructions say not to use edit or write, then carve out an exception to use write for saving the plan, creating contradictory operational guidance. Such ambiguity can lead agents or wrappers to misapply permissions, potentially enabling unintended file creation despite a supposed read-only mode.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Permitting env and printenv in a supposedly safe read-only planning mode exposes environment variables that commonly contain API keys, tokens, credentials, internal URLs, and other sensitive runtime data. This materially increases the risk of secret discovery and subsequent exfiltration, especially when combined with other allowed inspection commands or network access.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is described as a read-only exploration and planning aid, but allowing network fetches like curl and wget expands it beyond local inspection into outbound data access. Even if limited to GET-like usage, these commands can exfiltrate repository content, secrets, or metadata through crafted URLs, and they also introduce remote-content retrieval that is not necessary for safe planning.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/safe-commands.md (reported line 88)May include surrounding context.
md
- `sudo`, `su` - `kill`, `pkill`, `killall` - `reboot`, `shutdown` - `systemctl start/stop/restart/enable/disable` - `service <name> start/stop/restart` ### Editors (interactive)

Static analysis

No suspicious patterns detected.