toolchain-orchestrator

• Outcome: Review
• Latest audit: Aug 14, 2026 · 1:44 AM UTC
• Version: 1.0.0

Overview

The skill is a command-workflow orchestrator, but it runs arbitrary shell commands and keeps persistent learning data without enough safety boundaries.

Review before installing. Only run chain files you wrote and understand, because a chain can execute arbitrary local commands with your agent's privileges. Avoid placing secrets, credentials, private paths, or sensitive incident notes in learner preferences or notes, and inspect or delete learned_patterns.json if you do not want persistent local history.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (14)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

for dep, val in outputs.items():
            cmd = cmd.replace(f"{{{{{dep}}}}}", (val or "").strip())
        print(f"▶ 运行 {k}: {cmd}")
        r = subprocess.run(cmd, shell=True, capture_output=True, text=True)
        stdout = r.stdout
        if n.get("capture") == "stdout":
            outputs[k] = stdout

• Confidence: 98% confidence
• Finding: The orchestrator executes chain-defined commands with subprocess.run(..., shell=True), which allows arbitrary shell syntax and metacharacters to be interpreted. In this skill, commands are not only taken from the workflow definition but are also modified by injecting upstream node stdout into later commands, so attacker-controlled data can become executable shell content.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documents shell execution and file-writing behavior but does not declare permissions, creating a transparency and policy-enforcement gap. In an orchestration skill, undeclared shell access is especially risky because it can execute arbitrary user-defined commands and write artifacts or state to disk without explicit upfront notice or gating.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is workflow orchestration, but the documentation also introduces persistent learning, preference storage, and history retention that are not disclosed in the core description. This mismatch can mislead users and reviewers about the actual data handling and side effects, increasing the risk of unauthorized retention of sensitive workflow data or user preferences.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The added self-learning/memory system expands the skill beyond orchestration into persistent behavioral logging and adaptive state. This broadens the attack and privacy surface because workflow contents, errors, and notes may accumulate over time in a reusable local memory store without a narrowly justified need.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Collecting user preferences and long-term usage history is not necessary for basic DAG execution, validation, or reruns. Storing that information creates avoidable privacy and confidentiality risk, especially when user notes or error details may contain sensitive operational data.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file introduces a generic cross-skill telemetry and preference-learning subsystem that records usage history, notes, errors, and preferences, which is not necessary for a deterministic DAG orchestration skill. In this context, collecting and persisting behavioral data expands the privacy and trust boundary of the skill and can capture sensitive operational metadata without a clear need tied to the declared functionality.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The implemented behavior is materially different from the manifest: instead of orchestrating DAG-based toolchains, this file reads and writes a learned_patterns.json datastore for usage analytics, preferences, and self-reflection. That mismatch is dangerous because users and higher-level agents may grant trust or invoke the skill for orchestration while it silently performs unrelated persistent data collection, undermining transparency and increasing the chance of unauthorized data retention.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly supports executing user-defined shell commands but does not present a strong user-facing warning about the associated risk. In context, this is dangerous because command strings can perform arbitrary system actions, and the templated propagation of upstream output into downstream commands can amplify injection or destructive-command risks.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The persistent learning/memory feature is described without a clear privacy warning or consent model. Users may not realize that preferences, failures, notes, and usage history are retained across runs, which can expose sensitive operational details or personal data over time.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The prefer path stores arbitrary key/value preferences, and the record path can persist free-form notes and error details into learned_patterns.json without any warning, consent prompt, or data-sensitivity guidance. Because notes and preferences may contain secrets, personal data, command fragments, or environment details, this creates a realistic risk of sensitive information being retained on disk and later exposed to other tools or users on the same system.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This tool is explicitly designed to run arbitrary commands from chain definitions, but it provides no trust boundary, confirmation step, or restricted execution mode before launching them. In an agent setting, that means a malicious or unreviewed chain file can directly trigger local code execution with the privileges of the orchestrator process.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Persisting user preferences, notes, failure history, and usage patterns in a long-lived natural-language memory file creates a durable data leakage surface. Because orchestration tasks often involve commands, paths, environment details, and troubleshooting notes, the stored file can accumulate sensitive operational context that may later be exposed or reused inappropriately.

Unvalidated Output Injection

High

• Category: Output Handling

Content

for dep, val in outputs.items():
            cmd = cmd.replace(f"{{{{{dep}}}}}", (val or "").strip())
        print(f"▶ 运行 {k}: {cmd}")
        r = subprocess.run(cmd, shell=True, capture_output=True, text=True)
        stdout = r.stdout
        if n.get("capture") == "stdout":
            outputs[k] = stdout

• Confidence: 99% confidence
• Finding: The code replaces placeholders like {{node_id}} with raw stdout from upstream steps and then executes the resulting string through the shell. If any upstream command outputs shell metacharacters, command substitutions, separators, or redirections, a downstream node can be turned into an attacker-controlled command, enabling command injection across workflow edges.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

for dep, val in outputs.items():
            cmd = cmd.replace(f"{{{{{dep}}}}}", (val or "").strip())
        print(f"▶ 运行 {k}: {cmd}")
        r = subprocess.run(cmd, shell=True, capture_output=True, text=True)
        stdout = r.stdout
        if n.get("capture") == "stdout":
            outputs[k] = stdout

• Confidence: 97% confidence
• Finding: The skill exposes a powerful execution primitive where chain authors can supply arbitrary command lines and the runtime invokes them with shell=True. In the context of an agent skill whose purpose is toolchain orchestration, this materially increases danger because workflows may be generated, edited, or influenced by other tools or user content, turning the orchestrator into a general-purpose code-execution sink.

Static analysis

No suspicious patterns detected.