Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Kanban workflow helper that uses existing project-management CLI logins to read and update scoped work items, with live external changes users should understand before enabling.
Install only where the configured PM CLI account has the level of project access you intend. Expect commands such as start, update, ask, complete, and create to make real comments, labels/state changes, or new tasks in the configured system. Avoid enabling periodic progress updates or any future auto-reopen automation unless the cadence, visibility, and stop conditions are acceptable for your team, and update the flagged development dependencies before running tests or CI.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
The manifest includes vitest 2.1.9, which is reported as affected by critical advisories involving arbitrary file read and possible code execution/path traversal in Vitest-related server and mocking features. In this skill, vitest appears only as a devDependency, so the danger is mainly during local development or CI test execution rather than normal runtime use, but it can still expose developer workstations or CI runners if the vulnerable features are enabled.
The code is consistent with part of the declared description in that it is a TypeScript PM-platform adapter using CLI-based access only, specifically for Planka. However, the implementation materially underdelivers relative to the declared workflow verbs: setStage, addComment, and createInBacklogAndAssignToSelf are explicitly unimplemented, and comment/attachment/link listing are stubbed empty. The primary behavior of this chunk is read-only snapshot ingestion and stage mapping rather than the fuller workflow action surface suggested by the description. There is no evidence of undeclared external access beyond CLI usage, but there is a meaningful description-versus-behavior mismatch because core declared verbs are not actually implemented in this supplied code chunk.
The declared description describes a substantial Kanban workflow skill with PM integrations and operational commands. The actual code chunk contains only test runner configuration for Vitest, specifying the Node environment and test file inclusion pattern. This is not merely a supporting implementation detail for the declared behavior; on its own, the chunk does not implement or expose any of the described workflow capabilities. Therefore, the supplied code does not accurately represent the declared purpose.
Referenced artifact was not completely inspected
- `github.ts` (gh CLI)
Referenced artifact was not completely inspected
- `src/cli.ts` (provides `kanban-workflow <verb>`; see README for setup flags)
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
// Stop tracking work items that are no longer in progress.
for (const id of Object.keys(state.lastAutoCommentAt)) {
if (!inProgressSet.has(id)) delete state.lastAutoCommentAt[id];
}
const postedIds: string[] = [];
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
}
describe('setup', () => {
it('requires --force to overwrite existing config', async () => {
const fs = createMemoryFs({ 'config/kanban-workflow.json': '{"x":1}' });
const validate = vi.fn(async () => undefined);
The markdown explicitly states that the skill can post an automatic comment every 5 minutes while work is in progress. This is a user-data/system-impacting behavior, but the description does not include any warning about external posting, visibility to other users, or the need to opt in before enabling it.
Without declared permissions the skill's intent is opaque and cannot be validated.
The requirement mandates unattended write actions every 5 minutes while a task is in progress, but does not require explicit user opt-in, visibility, rate limits, or a clear stop/control mechanism beyond stage transitions. That creates a real safety issue because the agent can continuously modify external PM systems, generate noise or spam, and potentially leak transient work details into comments without the operator realizing persistent automated writes are occurring.
The auto-reopen rule silently changes task state on human comment for blocked or in-review items, with no user warning or approval. Silent state mutation is dangerous because routine comments can trigger workflow changes unexpectedly, causing task churn, bypassing reviewer intent, and creating integrity issues in project tracking that may be hard to attribute or detect.
This code executes CLI subprocesses to update issue state, add comments, create issues, and assign them to the current user. Although these actions are the adapter's core function, the file provides no user-facing confirmation, logging, or warning comments/docstrings around these state-changing operations, so users invoking the skill may not be explicitly informed that remote project data will be modified.
The show() verb explicitly requests comments with includeInternal: true and returns them in the response payload without any access-control check, redaction, or user-facing indication that internal/private comments are being exposed. In an agent skill context, this can leak sensitive staff-only discussion, triage notes, credentials, or security details to downstream consumers of the verb output.
The skill documents a setup step that writes config/kanban-workflow.json into the repository without warning the user that local files will be modified. In agentic environments, undisclosed file writes can surprise operators, alter repository state, and be chained with automation or commits, making the behavior more dangerous than an ordinary local CLI setup step.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"kanban-workflow": "tsx src/cli.ts"
},
"dependencies": {
"execa": "^9.6.0",
"zod": "^4.3.6"
},
"devDependencies": {
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
},
"dependencies": {
"execa": "^9.6.0",
"zod": "^4.3.6"
},
"devDependencies": {
"@types/node": "^22.13.5",
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"zod": "^4.3.6"
},
"devDependencies": {
"@types/node": "^22.13.5",
"tsx": "^4.19.2",
"typescript": "^5.8.2",
"vitest": "^2.1.9"
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
},
"devDependencies": {
"@types/node": "^22.13.5",
"tsx": "^4.19.2",
"typescript": "^5.8.2",
"vitest": "^2.1.9"
}
No suspicious patterns detected.