Security audit

P-Todo

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its P-Todo automation purpose, but its unauthenticated API can change, delete, and export task data and the code does not enforce the documented localhost-only exposure.

Install only if you intend to let trusted local agents or scripts fully control P-Todo data. Before use, bind the API explicitly to 127.0.0.1 or firewall the port, add authentication or confirmations for delete/export/settings actions, and treat exported files as potentially sensitive.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (386)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: With no manifest available, the skill's intended purpose is unknown, so opening a REST API server is an additional capability that is not justified by any stated scope in this file. The comment explicitly says the server is for external intelligent-agent use, which materially expands the app from a local GUI into a network-accessible service.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The class docstring presents an interface list as the API's exposed functionality, but it does not mention the later-registered `/api/settings/sound`, `/api/settings/language`, and `/api/export` endpoints. Since the code actually exposes configuration-changing and filesystem-writing operations, the documentation materially understates what this server does.

Intent-Code Divergence

Low

Confidence: 76% confidence
Finding: The interface comment for `PUT /api/todos/{id}` states it updates '任意字段' (any field), but assignment workflow is also implemented through a separate `/api/todos/{id}/claim` route with additional status mutation behavior. This makes the comment misleading about how all todo state transitions are actually handled.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The class-level documentation describes four columns as '待办、进行中、已完成、已取消', implying the CANCELLED column shows cancelled tasks. However, the implementation routes the CANCELLED column to overdue items via todoService.listOverdue(), and an inline comment explicitly states 'CANCELLED 列实际显示已逾期任务', contradicting the documented intent.

Intent-Code Divergence

Low

Confidence: 87% confidence
Finding: The inline comment says overdue items should be ordered with the longest-overdue first ('越久越前'). But the comparator for CANCELLED returns Integer.compare(oa, ob) where more overdue values are more negative, which places the most negative values first under ascending sort semantics; the code comment and comparator rationale are inconsistent and misleading about intent.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The comment says the heuristic treats records as postponed when the user actively pushed the deadline back. However, the implementation never compares an original due date to a new due date; it merely checks that updatedAt is after createdAt and that updatedAt is before 60 days from now. Any edit can satisfy this condition, so the documented intent contradicts actual behavior.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The permission text states 'Keine Netzwerkverbindung' and 'keine Übertragung von Nutzerdaten an externe Server', but earlier lines explicitly document a REST API served over HTTP on localhost. Even if limited to loopback, that is still a network-exposed capability, so the documentation contradicts itself about whether networking exists.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The permissions text says the app 'does not connect to the network' and implies no network exposure, yet the agent section explicitly describes an HTTP REST API endpoint and multiple callable routes on localhost. Even if bound only to 127.0.0.1, that is still network-facing behavior, so the documentation is internally contradictory.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The permission/about text says the app does not use network connections and does not upload data externally, yet elsewhere in the same resource file it explicitly advertises a built-in REST API at http://localhost:%d with multiple endpoints and no authentication. Listening on localhost is still a network capability, so this is an active contradiction in the documented intent rather than a mere omission.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The About text states that the app runs fully locally, does not connect to the network, and only listens on 127.0.0.1. However, elsewhere in the same file the app explicitly documents an embedded REST API service with a configurable listening port. A localhost listener is still a network-facing capability, so saying it does not connect to the network is contradictory documentation rather than merely incomplete wording.

Intent-Code Divergence

Low

Confidence: 99% confidence
Finding: The comment at L001 labels this as '简体中文' (Simplified Chinese), yet the filename is zh_tw and the strings are clearly Traditional Chinese throughout the file (for example '關於', '設置', '匯出'). This is an active documentation contradiction about the file's intent/localization target, even though it is not a code-execution risk.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: The guidance says contributors should 'always' pass GBK encoding flags on Windows, which is a locale-specific requirement expressed as a blanket instruction. This can conflict with the policy against forcing a specific language/locale without opt-in, especially since the document otherwise describes a multilingual project rather than a GBK-specific regional tool.

Natural-Language Policy Violations

Low

Confidence: 80% confidence
Finding: This line repeats a hard requirement for GBK on Windows without offering user choice or clarifying that it applies only to affected locale/encoding environments. Because it is written as an unconditional platform rule, it reads as a forced locale setting rather than an opt-in workaround.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: This file presents the license in several fixed languages/locales only, without any statement that users may choose a preferred language or that the locale set is limited for a documented reason. Under the stated policy, forcing a specific language/locale without user opt-in can be considered a natural-language policy issue.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The markdown states that AI agents can fully control the application, including creating, updating, deleting tasks and exporting data, but it does not include any warning about these actions affecting user data or exposing exported information. For a markdown skill description, user-facing disclosure is expected when behaviours can impact data integrity or privacy.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The listed triggers include generic words such as "todo", "task", and their equivalents in multiple languages, which commonly appear in ordinary conversation and are not specific to this skill. The description also says to use the skill whenever users need to interact with the app, but does not provide exclusion conditions or narrower invocation constraints.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The markdown describes delete, update, settings-change, and export operations such as deleting todos/users/comments and exporting data, but it does not include any warning about modifying or removing user data or changing application configuration. For a markdown skill description, these behaviors should be disclosed because they can affect user data and system integrity.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: The document specifies a fixed supported-language set and presents the skill in predefined locales, but it does not state that language selection is based on user preference or opt-in. This can conflict with language/locale policy expectations if the skill constrains interaction language without an explicit user choice.

Natural-Language Policy Violations

Low

Confidence: 83% confidence
Finding: The script's natural-language comments are written only in Chinese, which imposes a specific language/locale without any indication of user choice or documented regional justification. This matches the policy category for language or locale constraints expressed in natural language.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The JavaFX runtime options explicitly set file and platform encoding to GBK, which imposes a specific locale-dependent behavior on all users. This is a natural-language policy concern because the configuration does not offer any user choice or document a justified region-specific constraint.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: This batch file directly launches a Java application via shell execution, which is a safety-relevant operation for code files under the warning criteria. The file provides no user-facing disclosure such as a prompt, echo message, comment, or docstring explaining that it will execute the JAR.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The code explicitly sets global `file.encoding` and `sun.jnu.encoding` to `GBK`, which forces a specific locale/encoding behavior for all users. This is a natural-language policy concern because the file contains comments indicating the setting is intended for Chinese rendering, but there is no user choice or documented region-specific limitation.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The /api/export handler creates directories and writes exported data to disk, potentially to a caller-supplied path, but this method contains no confirmation, user-visible log/print, or comment/docstring warning about the file write behavior. Because this is a code file performing a safety-relevant file write, it should include some form of disclosure to make the side effect explicit.

Missing User Warnings

Low

Confidence: 79% confidence
Finding: The language settings handler accepts POST requests that change the application's current language, but there is no visible warning or explanatory disclosure in this code path that the request will alter global UI/application behavior. For user-affecting configuration changes, especially those that can surprise other users or sessions, the skill should make the effect explicit.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The class documentation and multiple user-facing log/messages are written in Chinese, and the UI explicitly uses the Chinese font "Microsoft YaHei". Under the policy, forcing a specific language or locale without user choice is a natural-language policy concern unless the constraint is clearly documented and justified as region-specific.

Static analysis

No suspicious patterns detected.