HoneyDew

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:41 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent HoneyDew Kanban helper, but it gives agents unauthenticated authority to modify and delete task-board data with limited guardrails.

Install only if you intend your agent to change HoneyDew data. Keep the HoneyDew API bound to localhost or a genuinely trusted network, avoid exposing it broadly, and require explicit confirmation before asking the agent to delete boards, columns, or cards.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill markets unauthenticated board and task management as convenient for 'hands-free' use but fails to prominently warn that there is no authentication protecting destructive operations. In this context, the missing warning increases the chance of unsafe deployment or overexposure, which could let unauthorized local-network actors alter, transfer, or delete task data.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill description says the agent can create, update, move, and delete cards and manage boards through the REST API, but it does not include any caution that these actions will change or remove task data. For a markdown file, user-facing documentation should warn about behaviors that can affect user data or system state.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README explicitly says no API keys are required and that the service is intended for local or trusted-network use, while also allowing the base URL to be pointed at another host on the network. That means task data and task-modifying commands may be sent to an unauthenticated HTTP service, enabling unauthorized access or manipulation by other users on the same network or by malware that can reach the service.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill exposes destructive delete operations for boards, columns, and cards without any warning, confirmation guidance, or note about irreversibility. In an agent-executed context, this increases the chance of accidental data loss from ambiguous user prompts or over-eager automation, especially because the API has no authentication and is intended for direct action.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Create a task

```bash
curl -X POST http://localhost:8000/api/cards \
  -H "Content-Type: application/json" \
  -d '{"column_id": 1, "title": "Write docs", "priority": 2, "profile": "jarvis"}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

)
```

Or via curl after moving to Done:

```bash
curl -X PATCH http://localhost:8000/api/cards/5 \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill markets unauthenticated board and task management as convenient for 'hands-free' use but fails to prominently warn that there is no authentication protecting destructive operations. In this context, the missing warning increases the chance of unsafe deployment or overexposure, which could let unauthorized local-network actors alter, transfer, or delete task data.

Static analysis

No suspicious patterns detected.