Helios Kanban Remote

• Outcome: Review
• Latest audit: Jul 31, 2026 · 8:27 AM UTC
• Version: 0.1.0

Overview

This is a disclosed Helios Kanban remote-control skill, but it needs review because it can self-install, persist shell configuration, start agents, approve actions, and delete tasks with limited local safeguards.

Install only if you intend this agent to control a specific Helios Kanban instance. Review INSTALL.md first, avoid autonomous sudo/brew installs, avoid writing to shell profiles unless you explicitly want persistence, and require explicit confirmation before approvals, starting agents, or deleting tasks.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to run shell commands (`bash scripts/hk.sh ...`) and even to read and execute an installation document, yet it declares no permissions. That mismatch undermines least-privilege controls and can cause the agent to invoke shell/network-capable behavior without transparent user or platform gating.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The install guide instructs the agent to append environment configuration to the user's shell startup file, creating persistent changes outside the skill's immediate remote-kanban control purpose. This broadens the skill's authority, can alter future shell behavior without clear consent, and may leave sensitive internal service URLs permanently exposed in the user's login environment.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The guide tells the agent to install system packages such as jq, including privileged package-manager commands, which exceeds the narrow purpose of remotely controlling an existing kanban service. This can trigger unreviewed system-wide changes, privilege escalation prompts, and package installation on hosts where the user did not authorize broader environment modification.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The instruction to recursively delete the temporary repository path is destructive and is presented as a routine step without an explicit warning or safeguards. Although the target path is intended to be a temp clone location, destructive deletion commands in agent-facing install docs are risky because variable misuse or unexpected environment values can cause data loss.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The install step deletes any existing installed skill directory before copying the new one, with no user-facing warning that prior contents will be overwritten. This can destroy local modifications, cached data, or other files under that path and is especially risky when executed autonomously by an agent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Persisting configuration by editing .bashrc or .zshrc changes the user's login environment without an explicit warning that shell startup files are being modified. This is dangerous because such files affect future sessions globally and may accumulate unintended or conflicting settings from autonomous agent actions.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The uninstall instructions permanently remove the installed skill directory with no warning that the action is irreversible. While uninstall naturally involves deletion, autonomous execution of rm -rf without confirmation can cause accidental loss of local customizations or user data stored under the skill path.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The manifest description uses broad triggers such as general requests to create tasks, start agents, or check progress, which can cause the skill to activate for common task-management conversations outside the Helios Kanban context. In this skill, overbroad activation is more dangerous because activation can lead to shell execution, remote HTTP control of a running service, and even self-install instructions from GitHub.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

cmd_tasks_delete() {
  require_jq
  api DELETE "/tasks/$1"
}

cmd_tasks_cancel() {

• Confidence: 92% confidence
• Finding: DELETE "/tasks/$1

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_resource_identifier

Plaintext HTTP endpoint targets a CGNAT/Tailscale-range address.

Critical

• Code: suspicious.exposed_resource_identifier
• Location: examples.md:6