Security audit

long-horizon-planner

Security checks for vulnerabilities and agentic risk

Overview

The planner is local and not malicious, but it also keeps persistent user-preference/history memory and encourages self-updating its own skill instructions, so it needs review before installation.

Install only if you are comfortable with this skill keeping local memory about usage, errors, notes, and preferences across runs. Avoid recording sensitive goals or preferences, clear learned_patterns.json when needed, and require manual review before allowing any updates to SKILL.md or other installed skill instructions.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 存在不匹配。planner.py 与描述基本一致，确实实现了里程碑 DAG、拓扑排序、关键路径、下一步推荐、进度推进和报告生成；但同一技能代码还包含 learner.py，这不是单纯的内部日志或错误处理，而是一个独立的通用学习/偏好管理/复盘分析模块，功能明显超出描述中宣称的“长程自主规划引擎”。因此代码执行了描述未提及的额外能力，并且会持久化记录用户偏好与操作历史，属于应标记的隐藏行为。

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The manifest describes a deterministic long-horizon planning engine that decomposes goals into milestone DAGs, computes topology/critical path, recommends next steps, and reports progress. However, this section introduces a separate learner that records usage history, error patterns, user preferences, and improvement suggestions across runs, which is a broader persistent personalization/telemetry capability not implied by the planning description.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: Lines L40-L43 present the skill as consisting of local deterministic planning primitives with reproducible results. Later, lines L53-L69 describe automatic post-use learning, storing mutable state in `learned_patterns.json`, and writing experience back into `SKILL.md`, which contradicts the earlier presentation of a fixed, reproducible planning tool.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The manifest describes a planning engine for decomposing goals into milestone DAGs, computing topological order and critical paths, and keeping long-horizon execution on track. This file instead documents and implements a generic telemetry/learning module that records usage, user preferences, recurring errors, and reflective suggestions for arbitrary skills, which is materially different from the stated planner behavior.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The manifest scope is planning and schedule analysis, but these functions persist operational history, error patterns, notes, and arbitrary user preference key/value data to disk. That data collection capability is not an obvious requirement for DAG planning, critical-path computation, or progress reporting.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The self_reflect routine analyzes accumulated error patterns and emits advice to write experience back into the skill's SKILL.md. A long-horizon planner may report progress, but automated meta-improvement guidance for the skill itself is a separate capability not described in the manifest.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: L06 使用“当用户/agent 需要……时调用”来描述激活条件，但列出的触发场景包含较宽泛的自然语言表述，如“制定多阶段计划”“长程任务不跑偏”，缺少明确边界、限定上下文或反例。这类描述容易与一般性的任务规划或求助表达重叠，增加非预期调用的风险。

Natural-Language Policy Violations

Medium

Confidence: 81% confidence
Finding: 文件中的自然语言说明整体仅以中文呈现，且没有提供语言可选项、用户偏好协商或区域适用性说明。按规则，若技能在自然语言层面强制特定语言而无用户 opt-in，可能构成语言/locale 策略违例。

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: This code file contains natural-language documentation and command descriptions entirely in Chinese, presenting the module as a general-purpose component for any WorkBuddy skill. Because the skill is framed as universally reusable but does not offer any language choice or state a justified locale restriction, it creates a language/locale policy concern under the natural-language policy rules.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: This code file contains natural-language documentation and CLI descriptions entirely in Chinese, including the module docstring and usage guidance. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.

Ssd 3

Medium

Confidence: 82% confidence
Finding: The skill describes a memory file that records 'user preferences' and explicitly says important user preferences should be written to `learned_patterns.json` for future direct reuse. This is a natural-language instruction to retain and reuse user-provided information across interactions, creating data-leak/privacy risk even though it does not use explicit exfiltration terminology.

Static analysis

No suspicious patterns detected.