Security audit

task-decomposition

Security checks for vulnerabilities and agentic risk

Overview

The task planner itself is local and simple, but the bundled learning module adds broad persistent recording and cross-skill file writes that deserve Review before installation.

Install only if you are comfortable with a local learning log that can store notes, errors, recent operations, and preferences. Use the decomposer outputs normally, but avoid putting secrets or confidential details into learner notes/preferences, and restrict learner.py to this skill's own directory unless you intentionally want it to modify another skill's learned_patterns.json.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as a simple task decomposition tool, but the documented learner.py behavior introduces persistent recording of usage data, preferences, errors, and reflective suggestions, including initialization and read/write of learned_patterns.json in arbitrary skill directories. This hidden stateful behavior expands the trust boundary, creates privacy and integrity risks, and can surprise users or orchestrators that expected a local stateless planner.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file implements a generic cross-use learning/telemetry subsystem that records capability usage, failures, notes, and user preferences to persistent storage, which materially exceeds a 'pure rule-based, local task decomposition' skill description. This creates undisclosed stateful data retention and profiling behavior, increasing privacy risk and expanding the skill's effective scope beyond what users would reasonably expect.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code provides a skill-agnostic tracking and preference-storage facility unrelated to decomposing goals into WBS steps. That mismatch is dangerous because it enables hidden behavior collection under the cover of an innocuous planning skill, undermining least privilege and informed user consent.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documentation advertises commands that write output files (--out wbs.json, --markdown wbs.md) and a learner workflow that records state, but it declares no tool scope or permissions boundaries. In an agent environment, undeclared file-write capability can lead to unauthorized workspace modification, unexpected persistence, or abuse by invoking the skill in contexts where write access was not intended.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description says to invoke the skill when the user says phrases like "帮我规划步骤" or "制定执行计划", which are broad and could match many general-assistance requests beyond this skill's intended scope. The file does not provide exclusion conditions or clearer trigger boundaries to distinguish when this skill should be used versus other planning or project-management skills.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The natural-language description and examples are presented as Chinese-first behavior, including the core transformation and workflow framing, while also accepting an English trigger phrase. There is no statement that users may choose their preferred language, which can conflict with a language/locale policy requiring opt-in rather than forcing a specific language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This Python skill's docstring, CLI description, examples, and generated content are all presented in Chinese, and the code does not provide any language or locale selection. That creates a natural-language policy concern because the skill implicitly forces a specific language without user opt-in or a documented region-specific justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstring and all user-facing CLI descriptions are written entirely in Chinese, which imposes a language/locale expectation on users. The policy allows locale constraints only when users are given a choice or the restriction is clearly justified, neither of which appears here.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: resolve_skill_dir accepts arbitrary directories or skill names under ~/.workbuddy/skills, allowing this script to read and write learning files for other skills, not just the current one. In context, that broadens access boundaries and creates a cross-skill tampering/privacy risk if the script is invoked with attacker-controlled arguments or reused unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: record_op stores free-form notes, error types, timestamps, and recent operation history in a local JSON file, which can capture sensitive operational details or user-provided content. The danger is amplified by silent persistence and lack of minimization, since notes may unintentionally include secrets, personal data, or confidential work context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: record_preference persistently stores arbitrary key/value preferences to disk without any user-facing warning or consent flow. Because preference values may contain sensitive personal or workflow information, silent retention creates a privacy and compliance risk even if data remains local.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.