Security audit

plandeck

Security checks for vulnerabilities and agentic risk

Overview

Plandeck is a local planning-board skill whose file writes, localhost server, and continuity data are disclosed and aligned with its purpose.

Install only if you want a local planning tool that writes planning and continuity files into your project. Keep the default localhost binding unless you are comfortable exposing board contents on a wider network, and remember that referenced card notes and receipts can appear in the local board API.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/screenshot.mjs:42