Kanban Workflow

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:53 AM UTC
• Version: 0.1.12

Overview

This skill is a coherent Kanban workflow helper that uses existing project-management CLI logins to read and update scoped work items, with live external changes users should understand before enabling.

Install only where the configured PM CLI account has the level of project access you intend. Expect commands such as start, update, ask, complete, and create to make real comments, labels/state changes, or new tasks in the configured system. Avoid enabling periodic progress updates or any future auto-reopen automation unless the cadence, visibility, and stop conditions are acceptable for your team, and update the flagged development dependencies before running tests or CI.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (29)

Known Vulnerable Dependency: vitest==2.1.9 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Known Vulnerable Dependency: vitest==2.1.9 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The manifest includes vitest 2.1.9, which is reported as affected by critical advisories involving arbitrary file read and possible code execution/path traversal in Vitest-related server and mocking features. In this skill, vitest appears only as a devDependency, so the danger is mainly during local development or CI test execution rather than normal runtime use, but it can still expose developer workstations or CI runners if the vulnerable features are enabled.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The code is consistent with part of the declared description in that it is a TypeScript PM-platform adapter using CLI-based access only, specifically for Planka. However, the implementation materially underdelivers relative to the declared workflow verbs: setStage, addComment, and createInBacklogAndAssignToSelf are explicitly unimplemented, and comment/attachment/link listing are stubbed empty. The primary behavior of this chunk is read-only snapshot ingestion and stage mapping rather than the fuller workflow action surface suggested by the description. There is no evidence of undeclared external access beyond CLI usage, but there is a meaningful description-versus-behavior mismatch because core declared verbs are not actually implemented in this supplied code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description describes a substantial Kanban workflow skill with PM integrations and operational commands. The actual code chunk contains only test runner configuration for Vitest, specifying the Node environment and test file inclusion pattern. This is not merely a supporting implementation detail for the declared behavior; on its own, the chunk does not implement or expose any of the described workflow capabilities. Therefore, the supplied code does not accurately represent the declared purpose.

Ae1

High

• Category: analysis-evasion

Content

- `github.ts` (gh CLI)

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- `src/cli.ts` (provides `kanban-workflow <verb>`; see README for setup flags)

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Known Vulnerable Dependency: postcss==8.5.6 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Known Vulnerable Dependency: vite==5.4.21 — 3 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-53632 (launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows)

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Memory Manipulation

High

• Category: Memory Poisoning

Content

// Stop tracking work items that are no longer in progress.
  for (const id of Object.keys(state.lastAutoCommentAt)) {
    if (!inProgressSet.has(id)) delete state.lastAutoCommentAt[id];
  }

  const postedIds: string[] = [];

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Self-Modification

High

• Category: Rogue Agent

Content

}

describe('setup', () => {
  it('requires --force to overwrite existing config', async () => {
    const fs = createMemoryFs({ 'config/kanban-workflow.json': '{"x":1}' });
    const validate = vi.fn(async () => undefined);

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The markdown explicitly states that the skill can post an automatic comment every 5 minutes while work is in progress. This is a user-data/system-impacting behavior, but the description does not include any warning about external posting, visibility to other users, or the need to opt in before enabling it.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The requirement mandates unattended write actions every 5 minutes while a task is in progress, but does not require explicit user opt-in, visibility, rate limits, or a clear stop/control mechanism beyond stage transitions. That creates a real safety issue because the agent can continuously modify external PM systems, generate noise or spam, and potentially leak transient work details into comments without the operator realizing persistent automated writes are occurring.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The auto-reopen rule silently changes task state on human comment for blocked or in-review items, with no user warning or approval. Silent state mutation is dangerous because routine comments can trigger workflow changes unexpectedly, causing task churn, bypassing reviewer intent, and creating integrity issues in project tracking that may be hard to attribute or detect.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This code executes CLI subprocesses to update issue state, add comments, create issues, and assign them to the current user. Although these actions are the adapter's core function, the file provides no user-facing confirmation, logging, or warning comments/docstrings around these state-changing operations, so users invoking the skill may not be explicitly informed that remote project data will be modified.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The show() verb explicitly requests comments with includeInternal: true and returns them in the response payload without any access-control check, redaction, or user-facing indication that internal/private comments are being exposed. In an agent skill context, this can leak sensitive staff-only discussion, triage notes, credentials, or security details to downstream consumers of the verb output.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The skill documents a setup step that writes `config/kanban-workflow.json` into the repository without warning the user that local files will be modified. In agentic environments, undisclosed file writes can surprise operators, alter repository state, and be chained with automation or commits, making the behavior more dangerous than an ordinary local CLI setup step.

Known Vulnerable Dependency: @vitest/mocker==2.1.9 — 1 advisory(ies): CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Low

• Category: Supply Chain
• Confidence: 60% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Known Vulnerable Dependency: esbuild==0.21.5 — 1 advisory(ies): GHSA-67mh-4wv8-2f99 (esbuild enables any website to send any requests to the development server and r)

Low

• Category: Supply Chain
• Confidence: 60% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Known Vulnerable Dependency: esbuild==0.27.3 — 1 advisory(ies): GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)

Low

• Category: Supply Chain
• Confidence: 60% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"kanban-workflow": "tsx src/cli.ts"
  },
  "dependencies": {
    "execa": "^9.6.0",
    "zod": "^4.3.6"
  },
  "devDependencies": {

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "dependencies": {
    "execa": "^9.6.0",
    "zod": "^4.3.6"
  },
  "devDependencies": {
    "@types/node": "^22.13.5",

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"zod": "^4.3.6"
  },
  "devDependencies": {
    "@types/node": "^22.13.5",
    "tsx": "^4.19.2",
    "typescript": "^5.8.2",
    "vitest": "^2.1.9"

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "devDependencies": {
    "@types/node": "^22.13.5",
    "tsx": "^4.19.2",
    "typescript": "^5.8.2",
    "vitest": "^2.1.9"
  }

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Static analysis

No suspicious patterns detected.