Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed connector to external Hannah and Elena AI services, so its network and credential use fit its stated purpose, though users should treat sent prompts and attachments as third-party data sharing.
Install only if you intend to share requests with Serviceplan/Sumike external services. Do not send secrets, regulated personal data, or confidential business files unless your organization has approved the service terms, data processing agreement, retention policy, and credential handling practices.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X GET https://hannah.sumike.ai/v1/coworkers \
-H "Authorization: Bearer sk-sumike-your-key-here"
The guide instructs users to send prompts, prior assistant messages, and detailed business context to external services, but it does not warn that this transmits potentially sensitive data off-platform. In a skill whose purpose is to connect to remote AI coworkers, omission of data-sharing/privacy guidance can lead users to disclose confidential research, customer, or operational information unintentionally.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const response = await fetch('https://hannah.sumike.ai/v1/chat/completions', {
method: 'POST',
headers: {
'Authorization': 'Bearer sk-sumike-your-key-here',
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://hannah.sumike.ai/v1/chat/completions \
-H "Authorization: Bearer invalid-key" \
-H "Content-Type: application/json" \
-d '{"messages":[{"role":"user","content":"test"}]}'
The debug section recommends verbose request inspection that reveals headers and full response bodies, but it does not warn that Authorization tokens and sensitive prompt/response content may be exposed in terminals, logs, shell history, or shared troubleshooting artifacts. This materially increases the chance of credential leakage and secondary disclosure of confidential data.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
max_attempts=5
while [ $attempt -le $max_attempts ]; do
response=$(curl -s -w "%{http_code}" -X POST https://hannah.sumike.ai/v1/chat/completions \
-H "Authorization: Bearer $HANNAH_KEY" \
-H "Content-Type: application/json" \
-d '{"messages":[{"role":"user","content":"test"}]}')
The README encourages sending natural-language requests and receiving attachments through external email addresses without warning that prompts, business data, and attached files may contain sensitive or regulated information. In this skill’s context, users are likely to submit research briefs, planning documents, spreadsheets, and presentations to a third-party service, which creates confidentiality, compliance, and data-leakage risk if users assume the channel is safe by default.
Earlier sections describe a task-based REST API using /v1/tasks and polling for results, while the later API reference describes direct OpenAI-style /v1/chat/completions endpoints as the primary API shape. These are materially different interaction models, so the documentation contradicts itself about what the code/interface actually does.
The API examples instruct the agent to send detailed task descriptions and business context to external services but do not clearly warn that this data leaves the local trust boundary. That omission increases the risk of inadvertent disclosure of sensitive strategy, customer information, or internal planning data to a third party.
The skill encourages sending natural-language requests and attachments over email to external third-party agents without an explicit warning about sensitive, regulated, or proprietary data disclosure. Users may forward confidential documents or personal data assuming this is an internal workflow, creating privacy, contractual, and compliance exposure.
The README tells users to export API keys directly into environment variables but does not state that these values are sensitive credentials that must be stored securely and never committed, logged, or shared. While environment variables are a common mechanism, omitting basic credential-handling guidance increases the chance of accidental exposure through shell history, screenshots, process dumps, CI logs, or misconfigured development environments.
The file states under 'AI Agents CAN' that agents can configure API keys in environment variables, but the surrounding guidance says humans must first obtain the keys and contact Serviceplan. This is an intent/documentation inconsistency about who performs credential setup, which could mislead users about the agent's role and authority.
The 'Available Tools' section documents tools such as hannah_create_task and elena_create_task, but later examples and the summary instruct agents to call hannah_research and elena_plan, which are not defined here. This is an active documentation contradiction that can misstate the skill's actual interface.
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
},
"dependencies": {},
"devDependencies": {
"typescript": "^5.3.0"
},
"peerDependencies": {},
"files": [
This is a manifest file, so vague-trigger checks apply. The description says users can 'Connect to Hannah and Elena' and 'Access via OpenAI-compatible API or email' but does not define any specific trigger phrases, scope limits, or exclusion conditions, which could make activation expectations ambiguous.
No suspicious patterns detected.