Pm Master

• Outcome: Pass
• Latest audit: Sep 22, 2026 · 2:57 PM UTC
• Version: 2.2.17

Overview

This skill is a broad project-management automation pack with file-writing, sub-agent orchestration, and optional email sending, but those behaviors are disclosed, purpose-aligned, and guarded.

Install only if you want a highly stateful PM automation skill that creates and updates project files, dispatches sub-agents, and can send formal email after an administrator enables and configures the email backend. Review config.yaml before use, keep email.enabled false unless needed, and use dry-run/preview modes for SOW parsing and sends.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (62)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied code is clearly PM-related and aligns with one subset of the description: generating a schedule/Gantt artifact from WBS data, including program and SOW views and some contract/milestone linkage. However, the declared description presents a much broader multi-capability skill, including email sending controls, confidentiality scanning, DOCX export, and expert-role dispatch. None of those capabilities appear in this code chunk. The code reads/writes project.yaml, computes forward schedules, renders Markdown, and updates artifact metadata; it does not send emails, scan for leaks, export DOCX, or dispatch roles. Therefore the description does not accurately represent what this specific code chunk actually does, even though the code is consistent with one narrower part of the declared PM functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The code is clearly PM-related and fits part of the declared domain: it generates SOW-level kickoff artifacts from project planning data. However, the declared description presents a much broader skill with multiple explicit capabilities beyond artifact generation, including email sending controls, confidentiality scanning, DOCX export, and expert-role dispatch. None of those capabilities appear in this code chunk. The code’s actual scope is much narrower: loading project.yaml, deriving SOW packages from the WBS, rendering kickoff Markdown, writing files, and updating artifact references. This is a material description-versus-behavior mismatch because the supplied code does not implement several specifically declared features and its primary purpose is only one specialized artifact generator within the larger claimed skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The supplied code is narrowly focused on generating sub-project PM artifacts from YAML using templates: raid_log.md, risk_register.md, and status_report.md. It updates the YAML artifact index and can resolve a sub-project by program file plus SOW ID. This aligns with part of the declared PM artifact-generation domain, especially sub-project RAID/risk/status reporting. However, the declared description presents a much broader skill with additional capabilities—email dispatch with approvals, confidentiality scanning, DOCX export, expert-role dispatch, and wider PM governance outputs—that are not implemented in this code chunk. The primary purpose in the code is therefore substantially narrower than the declared purpose, making the description inaccurate for this chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code is clearly PM-related and aligned with governance/quality-control aspects of the description, especially WBS/RAID/EVM/stage-gate/control-grade checks and expert-role enforcement. However, the declared description presents a much broader multi-function skill, including outbound email, confidentiality scanning, DOCX export, and artifact production/dispatch behaviors that do not appear in this code chunk. This script’s primary behavior is validation/blocking of project package consistency before delivery, not creation/export/communication. While some role-dispatch concepts are referenced via role inference and fatal checks, there is no actual dispatch implementation here. Therefore the supplied code chunk does not accurately represent the full declared description and includes several undeclared absences/material differences in capability emphasis.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The code clearly fits part of the declared PM governance/control purpose: it performs operational monitoring against a baseline, including schedule control, EVM, RAID-style issue/risk checks, milestone oversight, change control, lifecycle gate checks, and report generation. That aligns with the description's governance, monitoring, stage-gate, RAID, and EVM themes. However, the chunk’s actual primary purpose is narrower than the full declared skill: it is specifically an operational control engine rather than a general project/program management skill for creating the broad set of artifacts listed. More importantly for mismatch detection, it performs undeclared state mutation by rewriting the project YAML with last_control_check metadata and can act like a scheduled alert mechanism via exit codes. It also calls external consistency/artifact-guard checks not mentioned in the description. The extra declared features (email gateway, leak scan, DOCX export, expert dispatch) are not present in this code chunk, which does not itself prove the whole skill lacks them, but this supplied chunk does not represent them. Overall, there is a meaningful description-behavior mismatch because the description presents a broader multifunction PM skill while this code is a specialized control/inspection module with undeclared file-write and validation behaviors.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The supplied code aligns with only one narrow slice of the description: SOW/contract-informed expert-role dispatch planning. It loads a YAML project file, evaluates WBS items against a granularity threshold, infers roles, recommends experts, and emits a dispatch plan in Markdown or JSON. The script explicitly states it only audits and plans and does not modify project.yaml or perform the actual dispatch. The declared description, however, presents a much broader PM management skill with multiple additional capabilities (artifact production, email gateway, confidentiality scan, DOCX export). Since those capabilities are not represented in this code chunk and the primary behavior here is substantially narrower, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The code chunk is clearly related to project management, so it is not unrelated or malicious. However, the declared description represents a much broader multifunction PM skill, while this code only implements a narrow execution-driver component. Its concrete behavior is to load project.yaml, require an operational lifecycle state, compute executable versus blocked WBS items from status/dependencies, determine whether control_engine inspection is due, and print a report. None of the declared special capabilities—email gateway, confidentiality scan, Markdown-to-DOCX export, or contract/SOW dispatch—appear in this code. Because the description claims capabilities and a broader primary purpose not reflected by the supplied code chunk, this is a description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code chunk is narrowly focused on file-based state management for a project/program: get/set/show/exists, initialization of a project.yaml skeleton, schema migration, checkpoint tracking, and reading config.yaml. While the initialized schema includes PM-related fields (raid, metrics, wbs, milestones, governance), the script does not actually implement the broader declared skill behaviors such as producing management artifacts, sending approved outbound email, scanning for confidentiality leaks, exporting Markdown to DOCX, or dispatching expert roles from SOW/contracts. Thus the actual code represents only a small persistence component of the declared skill, and several prominent declared capabilities are absent from this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This code chunk does not implement the declared skill’s broad PM-management functionality. Its actual purpose is much narrower: render Markdown templates using supplied structured data. While such a renderer could support generation of PM artifacts as an internal component, the declared description presents a much larger end-user skill with multiple concrete capabilities—email sending controls, confidentiality scanning, DOCX export, and expert-role dispatch—that are entirely absent here. The code performs no network access, no document conversion, no security scanning, no approval workflow, and no contract-driven dispatch. Therefore the description materially overstates and misrepresents what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The supplied code aligns with a subset of the declared PM artifact functionality: it regenerates WBS, risk/RAID artifacts, a program charter, EVM report, baseline/control records, and schedules from project.yaml, including a DOCX render step for schedule gantt. However, the declared description presents a much broader skill with several explicit capabilities that are not implemented here, notably outbound email with mandatory approvals, confidentiality/leak scanning, and contract/SOW-based expert-role dispatch. The code’s actual primary purpose is narrower: SSOT artifact re-rendering and drift prevention via a command-line script. This is materially different from the declared skill as a comprehensive project/program management capability with additional communication/compliance/dispatch features. Over-declared capabilities are significant enough here to constitute a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a comprehensive project/program management skill with multiple major capabilities: PM planning/governance artifact production, controlled outbound email, confidentiality scanning, DOCX export, and SOW/contract-driven expert-role dispatch. The supplied code only implements the last of these categories: a taxonomy and inference utility for domains and expert roles based on text/spec content. It does not create PM artifacts, manage execution/monitoring/closure workflows, send email, perform approval enforcement, scan package contents for leaks, or export Markdown to DOCX. Because the actual code chunk’s primary purpose is much narrower and materially different from the declared end-to-end PM skill, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description presents a comprehensive PM skill with multiple operational features, governance controls, exports, communications, and dispatch behavior. The supplied code chunk does not implement that broad functionality. Instead, it is a specialized file-processing script focused on one sub-area: rolling up a WBS in project.yaml into summary, milestone, and component tiers, with optional progress aggregation. It reads and writes a local YAML file, preserves surrounding structure, creates a backup, and updates actuals.wbs_progress. While this is consistent with a small part of the declared PM/WBS domain, the overall declared purpose substantially overstates the implemented behavior, and several specifically claimed capabilities are entirely absent. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied code does perform one small subset adjacent to the declared domain: it computes a program-level rollup of subproject milestones and EVM/cost/status data, which loosely aligns with monitoring/status reporting. However, the declared description presents a much broader skill with many concrete capabilities—artifact production, governance workflows, email communications controls, confidentiality scanning, document export, and expert-role dispatch—that are absent from the code. The code’s primary purpose is materially narrower and different: it is a local reporting/aggregation script over YAML files. Because the description claims substantial capabilities not represented here and the actual implementation is only a specific rollup utility, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code does not match the declared description of a comprehensive project/program management skill. Its actual purpose is narrow: analyze a project schedule/WBS for dependency issues and compute scheduling outputs like critical path and slack. While this is loosely related to PM, it covers only one small subset of the declared functionality. The description promises many additional capabilities—document/artifact production, governance controls, email dispatch with approvals, confidentiality scanning, DOCX export, and expert-role dispatch—none of which appear in the code. There are also no trigger semantics matching the declared activation rules; instead, the script runs only via explicit CLI arguments. This is a material description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a full-featured project/program management skill with multiple PM artifact generation and governance functions plus several auxiliary capabilities (email dispatch controls, confidentiality scanning, DOCX export, contract-driven role dispatch). The supplied code does none of those things. Instead, it serves a narrow, different purpose: validating the structure and references of a sub-agent JSON report from the command line. It checks required JSON fields, validates certain enumerated values, verifies referenced artifact/data files exist on disk, and reports warnings/errors. While this could be tangentially related to a larger PM system, it is not an implementation detail of the declared capabilities shown here; it is a materially different functional purpose that is not represented in the description. Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

| Charter / WBS / Gantt / schedule generation | `init_project.py`, `parse_sow.py`, `build_schedule.py`, `build_wbs.py`, `render.py` | Spec-driven; `parse_sow.py

Lp1

High

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The script reads the PM_MASTER_REQUESTER environment variable when config.email.trust_env_requester is enabled. Even though the code correctly treats this as an untrusted audit label rather than an authorization factor, undeclared environment access can still weaken platform security assumptions and permit spoofed audit attribution if operators enable the trust flag without understanding the risk.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · CHANGELOG.md (reported line 15)May include surrounding context.

md

real inspection (control_engine.py) had not run — letting a deemed-but-not-run inspection
  suppress the next genuine control check. Removed the premature stamp; `last_control_check` is
  now written ONLY by `control_engine.py` after a real inspection (control_engine.py:631).
- **SQP-2 `parse_sow.py` · destructive SOW subtree replacement without confirmation**: the script
  deleted and replaced the SOW subtree on every run with no explicit gate. Added an `--apply`
  flag; `--dry-run` (and running with neither flag) is now a safe preview that writes nothing.
  When `--apply` is given it prints a removal/addition diff and still writes a dated backup

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · CHANGELOG.md (reported line 40)May include surrounding context.

md

variant is offered), not a user-facing language restriction.
- **SQP-1 `README.md`**: added a bounded activation-scope block with positive triggers and explicit
  negative examples (do-not-activate).
- **RA2 `CHANGELOG.md`**: reworded a historical "write back `wbs` dates" entry that tripped the
  session-persistence heuristic.

### Residual (documented, not a defect)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document explicitly states that the skill infers both domain and expert role from contract/SOW text, but it does not define hard boundaries or safety gates for that inference. In this skill context, misrouting can cause inappropriate expert prompts to be instantiated and produce incorrect or over-scoped technical artifacts, which is a real security and governance risk when downstream automation trusts those artifacts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file defines role activation triggers, so SQP-1 applies. Phrases like "requirements / user stories / specs / acceptance criteria" are broad and common across many software and PM contexts, but the file does not define exclusion conditions or narrower routing constraints for when this role should activate instead of overlapping roles such as product-manager, product-owner, or qa-engineer.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger text includes broad natural-language phrases such as "program," "portfolio," and "manage multiple related projects together," which can match routine user discussion rather than explicit intent to invoke the skill. In this skill, accidental activation is meaningful because it can initiate project scaffolding and downstream orchestration, increasing the chance of unintended file mutations or dispatch of PM workflows.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/sow-parsing-playbook.md (reported line 131)May include surrounding context.

md

- **Destructive replacement is gated behind `--apply`** (see §1): `parse_sow.py` deletes the old subtree for that SOW in `project.yaml` (`id == SOWn` or `id starts with "SOWn."`), then appends new packages → **idempotent, re-runnable, and always preceded by a dated backup** (`project.yaml.bak-<date>`). With neither `--apply` nor `--dry-run` it only prints a preview and writes nothing.
- Rolls up summary/milestone estimates; default dependency chain guarantees forward scheduling.
- Writes/updates that SOW's `fee` / `fee_type` / `methodology` / `status` in `sow_map`.
- Automatically runs `consistency_check.py` at the end; if a fixed-fee SOW has no billing milestone, the consistency gate **fails fatally** (see below).

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The guide explicitly encourages exporting deliverables and sending them to stakeholders, but this user-facing workflow does not consistently require a final human review, recipient confirmation, or confidentiality check immediately before transmission. Because PM artifacts often contain budgets, risks, staffing data, dependencies, and vendor/customer details, this can lead to unintended disclosure if the agent automates or strongly nudges outbound sharing.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/baseline.py (reported line 68)May include surrounding context.

python

def run(cmd):
    return subprocess.run([sys.executable] + cmd, capture_output=True, text=True)


def _date_integrity_ok(data):

Static analysis

No suspicious patterns detected.