Project Orchestrator

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:51 AM UTC
• Version: 0.2.0

Overview

This skill is a plausible coding-agent orchestrator, but it exposes powerful agent execution, code indexing, chat history, and database controls without adequate access controls.

Review this before installing. Use it only in an isolated, trusted local environment unless it is hardened first: bind services to loopback, add authentication and per-user authorization, replace all default credentials, restrict sync/watch and chat cwd to an explicit workspace, disable symlink escapes, remove permission-bypass agent execution, and pin the git dependency.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (7)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/chat/manager.rs:237
• Finding: Unauthenticated Remote Launch of Permission-Bypassed Claude Code Agents<![CDATA[ ## Vulnerability Details **File Location**: `src/main.rs:119-123`, `src/api/routes.rs:430-456`, `src/api/chat_handlers.rs:20-34`, `src/chat/manager.rs:237-275`, `src/chat/manager.rs:360-406` **Vulnerability Type**: Missing authentication combined with unrestricted agent execution **Risk Level**: Critical ### Vulnerable Code ```rust // src/main.rs:119-123 let addr = SocketAddr::from(([0, 0, 0, 0], config.server_port)); tracing::info!("Server listening on {}", addr); let listener = tokio::net::TcpListener::bind(addr).await?; axum::serve(listener, app).await?; ``` ```rust // src/api/routes.rs:430-456 .route( "/api/chat/sessions", get(chat_handlers::list_sessions).post(chat_handlers::create_session), ) .route( "/api/chat/sessions/{id}", get(chat_handlers::get_session).delete(chat_handlers::delete_session), ) .route( "/api/chat/sessions/{id}/stream", get(chat_handlers::stream_events), ) .route( "/api/chat/sessions/{id}/messages", get(chat_handlers::list_messages).post(chat_handlers::send_message), ) .route( "/api/chat/sessions/{id}/interrupt", post(chat_handlers::interrupt_session), ) ``` ```rust // src/chat/manager.rs:237-275 pub fn build_options( &self, cwd: &str, model: &str, system_prompt: &str, resume_id: Option<&str>, ) -> ClaudeCodeOptions { let mcp_path = self.config.mcp_server_path.to_string_lossy().to_string(); let mut env = HashMap::new(); env.insert("NEO4J_URI".into(), self.config.neo4j_uri.clone()); env.insert("NEO4J_USER".into(), self.config.neo4j_user.clone()); env.insert("NEO4J_PASSWORD".into(), self.config.neo4j_password.clone()); env.insert( "MEILISEARCH_URL".into(), self.config.meilisearch_url.clone(), ); env.insert( "MEILISEARCH_KEY".into(), self.config.meilisearch_key.clone(), ); let mcp_config = McpServerConfig::Stdio { command: mcp_path, args: None, env: Some(env), }; ...[truncated 2643 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require strong authentication for every chat and administrative endpoint. 2. Enforce per-user authorization and session ownership checks. 3. Replace `PermissionMode::BypassPermissions` with a restrictive permission mode. 4. Canonicalize `cwd` and reject any path outside an explicitly configured workspace root. 5. Bind to `127.0.0.1` by default unless an authenticated reverse proxy is configured. 6. Run each agent in an isolated sandbox with: - A read-only filesystem where possible. - A dedicated unprivileged user. - No host home-directory access. - Restricted outbound network access. - Resource and execution limits. 7. Maintain an allowlist of permissible MCP tools and require approval for destructive operations. 8. Add security tests proving that unauthenticated requests and out-of-workspace paths are rejected. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/chat/manager.rs:245
• Finding: Database Secrets Are Injected into a Permission-Bypassed Agent Environment<![CDATA[ ## Vulnerability Details **File Location**: `src/chat/manager.rs:245-271` **Vulnerability Type**: Excessive secret exposure and privilege propagation **Risk Level**: High ### Vulnerable Code ```rust let mut env = HashMap::new(); env.insert("NEO4J_URI".into(), self.config.neo4j_uri.clone()); env.insert("NEO4J_USER".into(), self.config.neo4j_user.clone()); env.insert("NEO4J_PASSWORD".into(), self.config.neo4j_password.clone()); env.insert( "MEILISEARCH_URL".into(), self.config.meilisearch_url.clone(), ); env.insert( "MEILISEARCH_KEY".into(), self.config.meilisearch_key.clone(), ); let mcp_config = McpServerConfig::Stdio { command: mcp_path, args: None, env: Some(env), }; let mut builder = ClaudeCodeOptions::builder() .model(model) .cwd(cwd) .system_prompt(system_prompt) .permission_mode(PermissionMode::BypassPermissions) .max_turns(self.config.max_turns) .include_partial_messages(true) .add_mcp_server("project-orchestrator", mcp_config); ``` ### Technical Analysis The Neo4j password and Meilisearch master/API key are copied into the environment used to launch the MCP server attached to each agent session. The same agent session is configured to bypass permission checks. Although the credentials are intended for the MCP child process, this architecture gives an attacker-controlled agent access to a tool server operating with broad database authority. It violates least privilege because a chat session only needs narrowly scoped orchestration operations, not unrestricted reusable backend credentials. ### Attack Path 1. An attacker creates or gains control of a chat session. 2. The server launches the agent with a privileged MCP server configuration. 3. The attacker prompts the agent to invoke available MCP operations against Neo4j or Meilisearch. 4. Because the MCP process possesses full backend credentials, operations execute with service-wide privileges. 5. The attacker reads, alters, poison ...[truncated 617 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not provide raw database credentials to agent-controlled execution contexts. 2. Place a trusted authorization broker between the agent and the databases. 3. Issue short-lived, narrowly scoped credentials per session and project. 4. Restrict each session to an explicit allowlist of read-only or task-specific MCP operations. 5. Require separate approval for destructive database operations. 6. Remove permission-bypass mode and sandbox the MCP process. 7. Rotate current Neo4j and Meilisearch credentials after hardening. 8. Redact secrets from logs, errors, debugging output, and process metadata. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/api/handlers.rs:454
• Finding: Unauthenticated Arbitrary-Directory Source Ingestion with Symlink Following<![CDATA[ ## Vulnerability Details **File Location**: `src/api/handlers.rs:454-473`, `src/orchestrator/runner.rs:205-318` **Vulnerability Type**: Arbitrary filesystem read and persistent data exposure **Risk Level**: High ### Vulnerable Code ```rust // src/api/handlers.rs:454-473 #[derive(Deserialize)] pub struct SyncRequest { pub path: String, } pub async fn sync_directory( State(state): State<OrchestratorState>, Json(req): Json<SyncRequest>, ) -> Result<Json<SyncResponse>, AppError> { let path = std::path::Path::new(&req.path); let result = state.orchestrator.sync_directory(path).await?; Ok(Json(SyncResponse { files_synced: result.files_synced, files_skipped: result.files_skipped, errors: result.errors, })) } ``` ```rust // src/orchestrator/runner.rs:229-235 for entry in WalkDir::new(dir_path) .follow_links(true) .into_iter() .filter_map(|e| e.ok()) .filter(|e| e.file_type().is_file()) { ``` ```rust // src/orchestrator/runner.rs:288-318 pub async fn sync_file_for_project( &self, path: &Path, project_id: Option<Uuid>, project_slug: Option<&str>, ) -> Result<bool> { let content = tokio::fs::read_to_string(path) .await .context("Failed to read file")?; let path_str = path.to_string_lossy().to_string(); if let Some(existing) = self.state.neo4j.get_file(&path_str).await? { use sha2::{Digest, Sha256}; let mut hasher = Sha256::new(); hasher.update(content.as_bytes()); let hash = hex::encode(hasher.finalize()); if existing.hash == hash { return Ok(false); } } let parsed = { let mut parser = self.parser.write().await; parser.parse_file(path, &content)? }; self.store_parsed_file_for_project(&parsed, project_id) .await?; ``` ### Technical Analysis The `/api/sync` endpoint accepts an arbitrary path and passes it directly into recursive directory travers ...[truncated 1640 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Authenticate and authorize all sync, watch, and code-search endpoints. 2. Canonicalize both the configured workspace root and requested path. 3. Verify that the canonical requested path starts with the canonical workspace root. 4. Disable symbolic-link following, or verify every resolved entry remains within the permitted root. 5. Associate indexed records with an authenticated principal and enforce access control during retrieval. 6. Add limits for traversal depth, file count, file size, total bytes, and operation duration. 7. Exclude sensitive directories and configurable secret-file patterns. 8. Avoid returning detailed filesystem paths to unauthorized clients. 9. Add tests for absolute-path traversal, `..` components, symlink escape, and oversized directory trees. ]]>

T02 · Agent Memory Poisoning

Error

• Location: src/api/chat_handlers.rs:60
• Finding: Unauthenticated Conversation Disclosure and Persistent Session Memory Poisoning<![CDATA[ ## Vulnerability Details **File Location**: `src/api/routes.rs:430-456`, `src/api/chat_handlers.rs:60-194`, `src/chat/manager.rs:408-425`, `src/chat/manager.rs:494-498`, `src/chat/manager.rs:626-645` **Vulnerability Type**: Missing session ownership checks and persistent attacker-controlled memory **Risk Level**: High ### Vulnerable Code ```rust // src/api/routes.rs:443-447 .route( "/api/chat/sessions/{id}/messages", get(chat_handlers::list_messages).post(chat_handlers::send_message), ) ``` ```rust // src/api/chat_handlers.rs:60-104 pub async fn send_message( State(state): State<OrchestratorState>, Path(session_id): Path<String>, Json(client_msg): Json<ClientMessage>, ) -> Result<Json<serde_json::Value>, AppError> { let chat_manager = state .chat_manager .as_ref() .ok_or_else(|| AppError::Internal(anyhow::anyhow!("Chat manager not initialized")))?; let message = match &client_msg { ClientMessage::UserMessage { content } => content.clone(), ClientMessage::PermissionResponse { allow, reason } => { format!( "Permission {}: {}", if *allow { "granted" } else { "denied" }, reason.as_deref().unwrap_or("") ) } ClientMessage::InputResponse { content } => content.clone(), }; if !chat_manager.is_session_active(&session_id).await { chat_manager .resume_session(&session_id, &message) .await .map_err(AppError::Internal)?; } else { chat_manager .send_message(&session_id, &message) .await .map_err(AppError::Internal)?; } ``` ```rust // src/chat/manager.rs:494-498 if let Some(ref mm) = memory_manager { let mut mm = mm.lock().await; mm.record_user_message(&prompt); } ``` ```rust // src/chat/manager.rs:626-645 if let Some(ref mm) = memory_manager { let assistant_text = assistant_text_parts.join("" ...[truncated 2274 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require authentication on all session and streaming endpoints. 2. Store an immutable owner or tenant identifier on each session. 3. Enforce owner and project authorization for listing, reading, sending, resuming, interrupting, and deleting. 4. Do not treat user messages as trusted long-term instructions. 5. Preserve provenance and trust level for every memory entry. 6. Separate trusted system context from untrusted conversation content. 7. Require explicit user confirmation before resuming an inactive privileged agent. 8. Apply retention limits and provide secure deletion for stored conversations. 9. Audit and rate-limit session enumeration and message submission. 10. Avoid exposing internal CLI session identifiers through public APIs. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: src/api/routes.rs:14
• Finding: Permissive Cross-Origin Access to Unauthenticated Administrative APIs<![CDATA[ ## Vulnerability Details **File Location**: `src/api/routes.rs:14-20`, `src/api/routes.rs:457-460` **Vulnerability Type**: Overly permissive CORS policy **Risk Level**: High ### Vulnerable Code ```rust pub fn create_router(state: OrchestratorState) -> Router { let cors = CorsLayer::new() .allow_origin(Any) .allow_methods(Any) .allow_headers(Any); ``` ```rust .layer(TraceLayer::new_for_http()) .layer(cors) .with_state(state) ``` ### Technical Analysis The server permits every web origin, HTTP method, and request header. Because the administrative API does not otherwise require authentication, an attacker-controlled website can issue cross-origin requests to a locally or remotely reachable orchestrator service. CORS is not an authentication mechanism. In this case, however, the wildcard policy removes the browser's same-origin protection and makes drive-by exploitation substantially easier. ### Attack Path 1. A victim runs the orchestrator on a machine where port 8080 is reachable from the browser. 2. The victim visits an attacker-controlled website. 3. JavaScript on that website sends cross-origin requests to the orchestrator. 4. The wildcard CORS policy permits those requests and allows the malicious origin to read responses. 5. The website creates agent sessions, submits messages, initiates filesystem sync, reads project data, or invokes destructive operations. ### Impact Assessment A malicious webpage can exercise the same unauthenticated API privileges as a direct network attacker. The resulting scope includes: - Launching permission-bypassed agent sessions. - Reading chat, project, task, note, and indexed-code data. - Triggering arbitrary-directory synchronization. - Starting filesystem watchers. - Modifying or deleting persistent records. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace wildcard CORS values with an explicit allowlist of trusted origins. 2. Permit only required methods and headers. 3. Require authentication and authorization independently of CORS. 4. Add CSRF protection where cookie-based authentication is used. 5. Disable browser-facing CORS entirely for local administrative deployments unless needed. 6. Bind the service to loopback by default. 7. Reject `null` and unexpected origins. 8. Add automated tests verifying that untrusted origins cannot invoke or read administrative endpoints. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: docker-compose.yml:5
• Finding: Published Backend Ports Use Hardcoded Repository-Known Credentials<![CDATA[ ## Vulnerability Details **File Location**: `docker-compose.yml:5-13`, `docker-compose.yml:25-33`, `docker-compose.yml:44-60` **Vulnerability Type**: Hardcoded credentials and insecure service exposure **Risk Level**: High ### Vulnerable Code ```yaml neo4j: image: neo4j:5.26.20-community container_name: orchestrator-neo4j ports: - "7474:7474" # HTTP Browser - "7687:7687" # Bolt environment: - NEO4J_AUTH=neo4j/orchestrator123 - NEO4J_PLUGINS=["apoc"] - NEO4J_dbms_security_procedures_unrestricted=apoc.* ``` ```yaml meilisearch: image: getmeili/meilisearch:v1.34.2 container_name: orchestrator-meilisearch ports: - "7700:7700" environment: - MEILI_MASTER_KEY=orchestrator-meili-key-change-me - MEILI_ENV=development ``` ```yaml orchestrator: ports: - "8080:8080" environment: - NEO4J_URI=bolt://neo4j:7687 - NEO4J_USER=neo4j - NEO4J_PASSWORD=orchestrator123 - MEILISEARCH_URL=http://meilisearch:7700 - MEILISEARCH_KEY=orchestrator-meili-key-change-me ``` ### Technical Analysis The recommended Compose deployment uses static credentials committed to the repository while publishing Neo4j and Meilisearch ports on host interfaces. Anyone with repository or documentation access knows the credentials. Neo4j is additionally configured to permit unrestricted APOC procedures. Meilisearch is run in development mode. These settings are unsuitable for any environment where the published ports are reachable by untrusted hosts. ### Attack Path 1. An attacker scans a host running the recommended Compose configuration. 2. The attacker connects to ports 7474/7687 or 7700. 3. The attacker authenticates using the repository-known Neo4j password or Meilisearch master key. 4. The attacker queries, modifies, or deletes stored graph and search data. 5. The attacker may use exposed source or conversation data to support further compromise. ### Impact Assessment Direct backend compromise bypasses all ...[truncated 341 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all fixed credentials from the repository and documentation defaults. 2. Generate unique, high-entropy secrets for each installation. 3. Supply credentials using Docker secrets, mounted secret files, or a secret manager. 4. Remove host port publication for Neo4j and Meilisearch unless explicitly required. 5. If host publication is necessary, bind to `127.0.0.1`, for example `127.0.0.1:7687:7687`. 6. Use firewall rules and authenticated TLS for remote backend access. 7. Disable unrestricted APOC procedures unless a documented feature requires them. 8. Run Meilisearch with production security settings. 9. Rotate credentials for every deployment created from the current defaults. 10. Add startup checks that reject known example credentials. ]]>

T08 · Insecure Dependencies

Warning

• Location: Cargo.toml:68
• Finding: Security-Critical SDK Is Loaded from an Unpinned Git Branch<![CDATA[ ## Vulnerability Details **File Location**: `Cargo.toml:68` **Vulnerability Type**: Unpinned source dependency and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```toml # Chat / Claude Code SDK nexus-claude = { git = "https://github.com/this-rs/nexus.git", features = ["memory"] } ``` ### Technical Analysis The `nexus-claude` dependency is fetched from a Git repository without a fixed `rev`. This dependency is security-critical because it implements Claude Code subprocess management, permission settings, MCP integration, streaming, and conversation memory. Without a pinned revision, the effective code used by a future build can change after the project itself has been audited. Compromise of the upstream branch, force-pushes, or unreviewed upstream changes can therefore alter executable behavior. This finding does not establish that the current upstream dependency is malicious; it identifies an avoidable supply-chain integrity weakness. ### Attack Path 1. The upstream default branch is compromised or receives an unsafe change. 2. A developer or CI system resolves or updates the Git dependency. 3. Cargo downloads and compiles the changed upstream source. 4. The altered code runs with the orchestrator's process privileges. 5. Because the SDK manages agent subprocesses and memory, the malicious change may access prompts, credentials, files, or backend data. ### Impact Assessment Successful supply-chain compromise would execute code with the orchestrator's authority. The potential scope includes: - Claude Code process control. - Prompt and conversation interception. - MCP configuration manipulation. - Access to backend credentials and project files. - Persistent corruption of conversation memory or orchestration data. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a reviewed immutable commit: ```toml nexus-claude = { git = "https://github.com/this-rs/nexus.git", rev = "<audited-commit-hash>", features = ["memory"] } ``` 2. Commit and enforce `Cargo.lock` for application builds. 3. Require dependency changes to pass code review and security testing. 4. Prefer a verified crates.io release with checksum-backed resolution when available. 5. Record upstream provenance and verify signed tags or commits. 6. Use `cargo-deny`, dependency auditing, and reproducible CI builds. 7. Review the SDK specifically for subprocess environment inheritance, permission handling, and memory storage behavior. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (229)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `POST /api/plans` - Create plan (with optional `project_id` to associate with project)
- `GET /api/plans/{id}` - Get plan details
- `PUT /api/plans/{id}/project` - Link plan to a project
- `DELETE /api/plans/{id}/project` - Unlink plan from project
- `GET /api/plans/{id}/next-task` - Get next available task
- `GET /api/plans/{id}/dependency-graph` - Get task dependency graph for visualization
- `GET /api/plans/{id}/critical-path` - Get longest dependency chain

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Task Dependencies
- `POST /api/tasks/{id}/dependencies` - Add dependencies after task creation
- `DELETE /api/tasks/{id}/dependencies/{dep_id}` - Remove a dependency
- `GET /api/tasks/{id}/blockers` - Get tasks blocking this task (uncompleted dependencies)
- `GET /api/tasks/{id}/blocking` - Get tasks blocked by this task

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Constraints
- `GET /api/plans/{id}/constraints` - Get plan constraints
- `POST /api/plans/{id}/constraints` - Add constraint (performance, security, style, etc.)
- `DELETE /api/constraints/{id}` - Remove constraint

### Code Exploration
- `GET /api/code/search?q=...` - Semantic search (with ranking scores)

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `POST /api/notes` - Create note (project_id, note_type, content, importance, tags)
- `GET /api/notes/{id}` - Get note details
- `PATCH /api/notes/{id}` - Update note (content, importance, status, tags)
- `DELETE /api/notes/{id}` - Delete note
- `GET /api/notes/search?q=...` - Semantic search across notes
- `GET /api/notes/context` - Get notes for entity (direct + propagated via graph)
- `GET /api/notes/needs-review` - List stale/needs_review notes

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `POST /api/notes/{id}/invalidate` - Mark note as obsolete
- `POST /api/notes/{id}/supersede` - Replace with new note
- `POST /api/notes/{id}/links` - Link note to entity
- `DELETE /api/notes/{id}/links/{type}/{entity}` - Unlink note from entity
- `GET /api/projects/{id}/notes` - List notes for a project

**Note Types:** `guideline`, `gotcha`, `pattern`, `context`, `tip`, `observation`, `assertion`

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `POST /api/workspaces` - Create workspace
- `GET /api/workspaces/{slug}` - Get workspace by slug
- `PATCH /api/workspaces/{slug}` - Update workspace
- `DELETE /api/workspaces/{slug}` - Delete workspace
- `GET /api/workspaces/{slug}/overview` - Overview with projects, milestones, resources, progress

**Workspace-Project Association:**

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**Workspace-Project Association:**
- `GET /api/workspaces/{slug}/projects` - List projects in workspace
- `POST /api/workspaces/{slug}/projects` - Add project to workspace
- `DELETE /api/workspaces/{slug}/projects/{id}` - Remove project from workspace

**Workspace Milestones (cross-project):**
- `GET /api/workspaces/{slug}/milestones` - List workspace milestones

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `POST /api/workspaces/{slug}/milestones` - Create workspace milestone
- `GET /api/workspace-milestones/{id}` - Get milestone with tasks
- `PATCH /api/workspace-milestones/{id}` - Update milestone
- `DELETE /api/workspace-milestones/{id}` - Delete milestone
- `POST /api/workspace-milestones/{id}/tasks` - Add task from any project
- `GET /api/workspace-milestones/{id}/progress` - Get completion progress

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `GET /api/workspaces/{slug}/resources` - List resources
- `POST /api/workspaces/{slug}/resources` - Create resource reference
- `GET /api/resources/{id}` - Get resource details
- `DELETE /api/resources/{id}` - Delete resource
- `POST /api/resources/{id}/projects` - Link project (implements/uses)

**Components & Topology:**

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `GET /api/workspaces/{slug}/components` - List components
- `POST /api/workspaces/{slug}/components` - Create component
- `GET /api/components/{id}` - Get component
- `DELETE /api/components/{id}` - Delete component
- `POST /api/components/{id}/dependencies` - Add dependency
- `DELETE /api/components/{id}/dependencies/{dep_id}` - Remove dependency
- `PUT /api/components/{id}/project` - Map to project

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `GET /api/components/{id}` - Get component
- `DELETE /api/components/{id}` - Delete component
- `POST /api/components/{id}/dependencies` - Add dependency
- `DELETE /api/components/{id}/dependencies/{dep_id}` - Remove dependency
- `PUT /api/components/{id}/project` - Map to project
- `GET /api/workspaces/{slug}/topology` - Full topology graph

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**Session management:**
- `GET /api/chat/sessions` — List sessions (pagination, `project_slug` filter)
- `GET /api/chat/sessions/{id}` — Get session details
- `DELETE /api/chat/sessions/{id}` — Delete session (closes active process)

**SSE Event types:**
```

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Sync & Watch
- `POST /api/sync` - Manual sync
- `POST /api/watch` - Start auto-sync
- `DELETE /api/watch` - Stop auto-sync

### Meilisearch Maintenance
- `GET /api/meilisearch/stats` - Get code index statistics

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Meilisearch Maintenance
- `GET /api/meilisearch/stats` - Get code index statistics
- `DELETE /api/meilisearch/orphans` - Delete documents without project_id

## Development Guidelines

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

MCP Config Access

High

• Category: Agent Snooping

Content

### 2. Configure your AI tool

Add to your MCP configuration (e.g., `~/.claude/mcp.json`):

```json
{

• Confidence: 95% confidence
• Finding: The README instructs users to place live service credentials directly into an MCP client configuration file under a home-directory path, including example passwords and API keys. In agent-integrated environments, such config files may be readable by local tools, plugins, backup systems, or other agents, making credential exposure and unauthorized access to the code graph and search backend more likely.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared description presents a full AI agent orchestrator with specific subsystems: Neo4j, Meilisearch, and Tree-sitter, intended to coordinate multiple coding agents. The supplied code chunk does not implement orchestration or any of those named capabilities. It is only a helper script that queries two HTTP endpoints on an existing orchestrator service to retrieve JSON context or a generated prompt for a task. This is materially narrower than the declared purpose, so the description does not accurately represent the behavior of the provided code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The code chunk is narrowly a Bash wrapper around orchestrator REST endpoints for managing plans and tasks. While this partially aligns with the 'shared context and plans' aspect of orchestration, it does not demonstrate the prominently declared capabilities: Neo4j knowledge graph integration, Meilisearch search, or Tree-sitter parsing. Its actual role is a plan-management client script, not a full AI agent orchestrator. Therefore the description materially overstates and mischaracterizes what this specific code chunk does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The declared description presents the skill as a broad AI agent orchestrator with Neo4j, Meilisearch, and Tree-sitter for coordinating multiple coding agents. The supplied code chunk is much narrower and materially different: it defines Axum handlers for chat-related endpoints, including creating/resuming sessions, sending messages, interrupting, SSE subscriptions, message history retrieval, and session CRUD. While Neo4j appears in session listing/get/delete operations, that is only for chat session storage/retrieval. There is no evidence in this chunk of Meilisearch integration, Tree-sitter parsing, knowledge-graph-driven orchestration, or multi-agent coordination. This is a substantive description/behavior mismatch rather than a mere partial implementation detail.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared description presents the skill as an AI agent orchestrator centered on coordinating multiple coding agents using Neo4j, Meilisearch, and Tree-sitter. The supplied code chunk is instead narrowly focused on REST-style handlers for a knowledge notes API. Its primary behavior is managing notes and their lifecycle, including search, contextual retrieval, linking to entities, propagation, confirmation, invalidation, supersession, and staleness updates. While there is some thematic overlap with a knowledge graph/orchestrator system and one Neo4j-backed lookup, the concrete functionality here is not agent coordination or planning. The mismatch is material because the code’s primary purpose is a note-management API subsystem, and key declared technologies/capabilities like Meilisearch search integration and Tree-sitter parsing are not represented in this code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The supplied code chunk is a utility module for common HTTP/API query parameters and paginated responses. Its concrete behavior is limited to parsing and validating pagination/filter inputs and formatting paginated outputs. This is materially different from the declared purpose of an AI agent orchestrator with graph/search/parser integrations. None of the advertised systems or capabilities appear in the code, so the description does not accurately represent this code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The declared description emphasizes an AI agent orchestration system with Neo4j, Meilisearch, and Tree-sitter, intended for coordinating coding agents on complex projects. The supplied code chunk does not implement agent coordination, search, parsing, or planning behavior. Instead, it is a set of backend API handlers for managing domain entities in a workspace system: workspaces, projects, milestones, resources, components, dependencies, and topology. While use of a Neo4j-backed orchestrator is consistent with part of the description, the primary behavior here is CRUD/API administration over project metadata, not AI orchestration. This is a material description-behavior mismatch for this chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description emphasizes an AI agent orchestration system with knowledge graph, search, and parsing capabilities for coordinating coding agents. The supplied code chunk instead provides infrastructure for WebSocket-based real-time event delivery to clients. Its primary behavior is accepting a WebSocket upgrade, subscribing to an event bus, filtering events, serializing them to JSON, and maintaining the socket with ping/pong handling. Those behaviors are not represented in the declared description, and the headline capabilities named in the description are not present in this code chunk. This is a material description-to-behavior mismatch rather than a mere supporting implementation detail.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The declared description emphasizes a general multi-agent coding orchestrator with Neo4j, Meilisearch, and Tree-sitter parsing. This code chunk instead focuses on managing interactive Claude Code chat sessions: spawning/resuming CLI clients, streaming responses, handling interrupts, maintaining active session state, and persisting chat metadata/history. It does use Neo4j and Meilisearch for context and memory, which partially aligns with the description, but there is no evidence here of Tree-sitter parsing or explicit coordination among multiple coding agents. The primary purpose is materially different: chat session orchestration for a single LLM/CLI workflow rather than a broader multi-agent orchestrator.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description centers on a multi-agent coding orchestrator backed by Neo4j, Meilisearch, and Tree-sitter. The supplied code chunk instead exposes a chat module with streaming/session-oriented conversational capabilities. These are materially different primary purposes. While a chat interface could be a supporting component in a larger orchestrator, this specific chunk does not reflect the declared graph/search/parsing/orchestration functionality and instead advertises a different subsystem.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The supplied code chunk does not implement an AI agent orchestrator or show behavior related to coordinating multiple coding agents, searching with Meilisearch, or parsing with Tree-sitter. Instead, it is a type-definition module for a chat subsystem, including request/response/event enums and session metadata with serde support and tests. The mention of Neo4j appears only in a comment on persisted session metadata, not as actual graph operations. This is a materially different primary purpose from the declared description, so the description does not accurately represent this code chunk.

Static analysis

No suspicious patterns detected.