ClawHub
Back to skill

Security audit

Kanban Workflow Export

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a real Kanban automation tool, but it can persist scheduled automation and act on authenticated project-management accounts, with some under-scoped credential and Linear query handling risks.

Install only with scoped PM accounts or tokens, review the selected adapter's permissions first, avoid enabling `--autopilot-install-cron` until you are comfortable with recurring stage changes, and prefer updating/auditing dependencies plus hardening the Linear wrapper before use in sensitive workspaces.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/linear_json.sh:41
Finding

Linear API Key Exposed Through Process Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/linear_json.sh:49
Finding

GraphQL Injection Through Unvalidated Linear Scope Identifiers

Content
View full analysis
" >&2 exit 1 fi # Note: Linear's GraphQL supports querying team by ID. gql "{ team(id: \"$team_id\") { issues(first: 250, filter: { state: { type: { nin: [\\\"completed\\\", \\\"canceled\\\"] } } }) { nodes { id title url updatedAt state { id name type } } } } }" \ | jq -c '{data:{issues:{nodes:(.data.team.issues.nodes // [])}}}' ;; issues-project) project_id="${1:-}" if [[ -z "$project_id" ]]; then echo "Usage: linear_json.sh issues-project " >&2 exit 1 fi gql "{ project(id: \"$project_id\") { issues(first: 250, filter: { state: { type: { nin: [\\\"completed\\\", \\\"canceled\\\"] } } }) { nodes { id title url updatedAt state { id name type } } } } }" \ | jq -c '{data:{issues:{nodes:(.data.project.issues.nodes // [])}}}' ;; ``` The corresponding configuration schema accepts unrestricted strings: ```ts /** Provide either teamId OR projectId when viewId is not provided (exactly one). */ teamId: z.string().optional(), projectId: z.string().optional(), ``` ### Technical Analysis The Linear team and project identifiers are inserted directly into GraphQL source code inside a quoted argument. The values are only checked for non-emptiness and are not constrained to Linear's expected identifier format. A crafted identifier containing GraphQL quotation marks, delimiters, fields, braces, or comment syntax can terminate the intended string and alter the query's structure. This is GraphQL injection rather than shell-command injection: Bash does not recursively execute shell syntax contained in the expanded va ...[truncated 1822 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
Findings (33)

Known Vulnerable Dependency: vitest==2.1.9 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical
Category
Supply Chain
Confidence
90% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vitest==2.1.9 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical
Category
Supply Chain
Confidence
98% confidence
Finding

The file explicitly includes vitest 2.1.9, which is reported as affected by critical advisories involving arbitrary file read and possible code execution when the Vitest UI server or redirect-mock functionality is exposed. Even though Vitest is a devDependency, this skill is CLI- and automation-oriented, so test tooling may run in developer workstations or CI environments where sensitive source, tokens, and workspace files are present, making the impact significant if the vulnerable features are used.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description describes a substantive Kanban workflow skill with task-stage management and CLI-based PM integrations. The supplied code chunk does not implement any of those behaviors. Instead, it is purely a Vitest configuration file that sets the test environment and test file glob. This is a materially different primary purpose and does not represent the described functionality.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md
- `github.ts` (gh CLI)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md
- `src/cli.ts` (provides `kanban-workflow <verb>`; see README for setup flags)

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High
Category
Supply Chain
Confidence
80% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.6 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High
Category
Supply Chain
Confidence
80% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==5.4.21 — 3 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-53632 (launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows)

High
Category
Supply Chain
Confidence
80% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · src/automation/progress_updates.ts (reported line 39)May include surrounding context.

ts
// Stop tracking work items that are no longer in progress.
  for (const id of Object.keys(state.lastAutoCommentAt)) {
    if (!inProgressSet.has(id)) delete state.lastAutoCommentAt[id];
  }

  const postedIds: string[] = [];

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · tests/setup.test.ts (reported line 34)May include surrounding context.

ts
}

describe('setup', () => {
  it('requires --force to overwrite existing config', async () => {
    const fs = createMemoryFs({ 'config/kanban-workflow.json': '{"x":1}' });
    const validate = vi.fn(async () => undefined);

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill explicitly documents use of external binaries, environment variables, setup-time validation, and cron installation, but it does not declare any explicit tool scope such as permissions or allowed-tools. That makes the skill's operational authority ambiguous and can lead an agent runtime to grant broader shell/env access than a user expects, increasing the chance of unintended command execution or credential exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented --autopilot-install-cron option creates a persistent scheduled job, yet the skill text does not emphasize the security and operational implications of installing recurring execution. Persistent cron execution can repeatedly invoke shell-capable automation, amplify mistakes, and create long-lived background behavior a user did not fully intend.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Requiring show/next to output private or internal comments exposes potentially sensitive information to the agent and downstream consumers of its output. Because next automatically reuses show, the exposure can happen during routine task selection, increasing the chance of unnecessary data access and leakage of confidential internal notes, credentials, customer data, or security-relevant discussion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The requirement mandates automatic external writes every 5 minutes while a task is in progress, but does not require explicit user awareness, consent, or a clear way to disable the behavior. In an agentic environment, background posting can leak work context, create audit noise, and cause unintended disclosure of sensitive implementation details to external PM systems without the operator realizing ongoing writes are occurring.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Silent automatic reopening on any human comment changes remote task state without a user-visible confirmation or approval step. This can be abused or triggered unintentionally, causing workflow manipulation, confusing task ownership/state, and unauthorized external side effects that the agent operator may not expect.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/linear_json.sh (reported line 17)May include surrounding context.

sh
#
# Requirements: LINEAR_API_KEY, curl, jq

API="https://api.linear.app/graphql"

if [[ -z "${LINEAR_API_KEY:-}" ]]; then
  echo "Error: LINEAR_API_KEY not set" >&2

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/linear_json.sh (reported line 24)May include surrounding context.

sh
exit 1
fi

if ! command -v curl >/dev/null 2>&1; then
  echo "Error: curl not found" >&2
  exit 1
fi

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code performs a mutating operation by updating an issue's state through the Plane CLI, which changes remote user data. Although the file-level comment documents the command, there is no user-facing confirmation, logging, or inline warning associated with this destructive state transition in the method itself.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest describes a kanban workflow skill with setup, workflow verbs, polling/diffing foundations, and automation hooks, but this file goes beyond PM-platform interaction by invoking a local executable to create a scheduled cron job. Spawning an external process to persist automation on the host is a materially stronger capability than ordinary workflow management and is not clearly justified by the stated purpose alone.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The setup flow states that it writes config/kanban-workflow.json, but the skill does not clearly warn the user that running setup will modify the local workspace. Silent file creation or overwrite can surprise users, interfere with repositories, or be abused to persist unwanted configuration in automated environments.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @vitest/mocker==2.1.9 — 1 advisory(ies): CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Low
Category
Supply Chain
Confidence
60% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: esbuild==0.21.5 — 1 advisory(ies): GHSA-67mh-4wv8-2f99 (esbuild enables any website to send any requests to the development server and r)

Low
Category
Supply Chain
Confidence
60% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: esbuild==0.27.3 — 1 advisory(ies): GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)

Low
Category
Supply Chain
Confidence
60% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json
"kanban-workflow": "tsx src/cli.ts"
  },
  "dependencies": {
    "execa": "^9.6.0",
    "tsx": "^4.19.2",
    "zod": "^4.3.6"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json
},
  "dependencies": {
    "execa": "^9.6.0",
    "tsx": "^4.19.2",
    "zod": "^4.3.6"
  },
  "devDependencies": {

Static analysis

No suspicious patterns detected.