T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:164- Finding
Unpinned npm Package Retrieval and Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Helios Kanban Remote
Security checks for vulnerabilities and agentic risk
Overview
This looks like a real Helios Kanban remote-control skill, but it grants broad task, agent, approval, install, and local execution authority with under-scoped safeguards.
Install only if you trust the Helios Kanban server, repository, and npm package source. Pin versions or commits before installation, avoid running the sudo and npx commands automatically, keep the server behind an authenticated private network, confirm deletes and approvals manually, and treat tag content as untrusted before sending it to a coding agent.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T03 · Remote Payload Retrieval and Execution
Warning
- Location
INSTALL.md:81- Finding
Mutable Development Branch Installed Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/hk.sh:5- Finding
Sensitive Remote-Control Operations Use a Plaintext Channel Without Client Authentication
- Content
View full analysis
&2 exit 1 fi ``` The same request helper performs destructive and security-sensitive operations: ```bash cmd_tasks_delete() { require_jq api DELETE "/tasks/$1" } ``` ```bash result=$(api POST "/task-attempts" -d "$payload") ``` ```bash result=$(api POST "/sessions/${RESOLVED_SESSION_ID}/follow-up" -d "$payload") ``` ```bash payload=$(jq -n --arg ep "$process_id" \ '{execution_process_id: $ep, status: {status: "approved"}}') api POST "/approvals/${approval_id}/respond" -d "$payload" ``` ### Technical Analysis The API client defaults to plain HTTP and only sends a content-type header. It does not provide a bearer token, API key, request signature, or mutual-TLS client identity. Documentation also uses HTTP URLs for remote hosts. The audited client therefore supplies neither transport confidentiality nor client-side authentication. Whether the server independently enforces another access-control layer is outside the supplied project, but this client is not capable of satisfying such a mechanism as written. Because the same helper is used for task deletion, Agent startup, prompt submission, and approval responses, interception or unauthor ...[truncated 1376 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
scripts/hk.sh:160- Finding
Server-Controlled Tag Content Is Injected Into Coding-Agent Prompts
- Content
View full analysis
/dev/null || echo "[]") if ! echo "$tags" | jq -e 'type == "array" and length > 0' >/dev/null 2>&1; then printf '%s' "$text" return fi jq -n --arg text "$text" --argjson tags "$tags" ' reduce $tags[] as $t ($text; gsub("@\($t.tag_name)"; $t.content)) ' -r } ``` Task descriptions are expanded before submission: ```bash if [[ -n "$desc" ]]; then desc=$(expand_tags "$desc") fi ``` Follow-up prompts are expanded and sent to an Agent session: ```bash local id="$1" shift local prompt="$*" if [[ -z "$prompt" ]]; then echo "error: prompt required" >&2 exit 1 fi prompt=$(expand_tags "$prompt") resolve_latest_session_for "$id" ``` ```bash if [[ "$running" == "true" ]]; then mode="queued" local qpayload if [[ -n "$RESOLVED_VARIANT" ]]; then qpayload=$(jq -n \ --arg message "$prompt" --arg ex "$RESOLVED_EXECUTOR" --arg var "$RESOLVED_VARIANT" \ '{message: $message, executor_profile_id: {executor: $ex, variant: $var}}') else qpayload=$(jq -n \ --arg message "$prompt" --arg ex "$RESOLVED_EXECUTOR" \ '{message: $message, executor_profile_id: {executor: $ex}}') fi result=$(api POST "/sessions/${RESOLVED_SESSION_ID}/queue" -d "$qpayload") else mode="follow_up" result=$(api POST "/sessions/${RESOLVED_SESSION_ID}/follow-up" -d "$payload") fi ``` ### Technical Analysis `expand_tags` retrieves tag names and contents from the remote Kanban server. It substitutes each matchi ...[truncated 1879 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (27)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 86% confidence
- Finding
Chaining privileged package-manager commands with
&&encourages unattended execution of multiple system-modifying steps as a single action. In an agent context, this reduces opportunities for review or intervention and amplifies harm if the first step succeeds in an unsafe environment.- Content
brew install jq
Debian/Ubuntu
sudo apt-get update && sudo apt-get install -y jq
text ---
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bash scripts/hk.sh <command> [args]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bash scripts/hk.sh <command> [args]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bash scripts/hk.sh <command> [args]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bash scripts/hk.sh <command> [args]
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh cmd_tasks_delete() { require_jq api DELETE "/tasks/$1" } cmd_tasks_cancel() {
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The guide explicitly instructs the agent to autonomously clone repositories, run shell commands, modify local files, and complete installation without human manual steps. For a remote kanban-control skill, these broad local actions exceed narrow task usage and create unnecessary risk if followed by an agent in a sensitive environment.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash REPO_DIR="$(git rev-parse --show-toplevel 2>/dev/null || pwd)" test -f "$REPO_DIR/skills/helios-kanban-remote/SKILL.md" || { echo "error: skill not found in current repo"; exit 1 } echo "Using local repo: $REPO_DIR"
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash REPO_DIR="$(git rev-parse --show-toplevel 2>/dev/null || pwd)" test -f "$REPO_DIR/skills/helios-kanban-remote/SKILL.md" || { echo "error: skill not found in current repo"; exit 1 } echo "Using local repo: $REPO_DIR"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The installation step uses
rm -rfto delete the existing skill directory and then overwrites it without backup or confirmation. This is destructive behavior that can remove local customizations or prior installations and is unsafe for an autonomous agent to perform silently.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The guide instructs the agent to install missing dependencies using system package managers, including privileged
sudocommands. This expands the blast radius from skill setup to host-level modification and could alter the user's system without informed approval.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The guide includes
sudo apt-get update && sudo apt-get install -y jq, instructing the agent to run privileged commands. Any autonomous use of sudo materially raises risk because it permits host-wide changes and makes compromise of the installation flow far more impactful.- Content
brew install jq
Debian/Ubuntu
sudo apt-get update && sudo apt-get install -y jq
text ---
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The installer tells the agent to persist environment configuration by editing shell profile files. Persistent modification of user startup files is a sensitive local change that can affect future sessions and is not strictly necessary for immediate skill operation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Persisting configuration by appending to shell profile files without an explicit warning or approval creates lasting side effects in the user's environment. Even if the value is benign, silent profile edits violate least surprise and can cause configuration drift or conflicts.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The guide instructs the agent to start a server-side/local process with
npx helios-kanban, which is beyond simple remote control of an existing kanban service. Running new services locally can expose ports, consume resources, and execute unreviewed code in the user's environment.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
The install guide tells the agent to run
npx helios-kanbanwithout pinning a specific package version or integrity source. That allows execution of whatever package version is current at install time, increasing supply-chain risk if the package is compromised, renamed, or unexpectedly changed.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The uninstall instructions irreversibly delete the skill directory with
rm -rfand provide no warning, backup, or path validation guidance. Autonomous execution of such deletion can remove data unexpectedly if variables are mis-set or if the user expected a reversible uninstall.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill explicitly instructs the agent to run shell commands (
bash scripts/hk.sh ...) and even to self-install from GitHub, but it declares nopermissionsorallowed-toolsscope. That creates an authorization gap where a host agent may grant broader shell capability than intended, increasing the blast radius of prompt-induced command execution or destructive task operations.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest description includes broad activation cues like creating tasks, starting agents, or checking progress remotely, which can match common project-management requests outside a clearly confirmed Helios Kanban context. Misactivation is risky here because this skill has shell/network operational power and can trigger state-changing actions against a remote service.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The skill tells operators to start the service with
npx helios-kanbanand later referenceshelios-kanban@latestfor MCP, which pulls code that is not pinned to a reviewed version. This introduces supply-chain risk: a compromised package, malicious update, or breaking change could be executed automatically in a privileged environment.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The 'Response format for chat' section specifies output labels entirely in Chinese, and nearby examples are also Chinese-centric. There is no indication that the language should match user preference or that other locales are supported, which can violate language/locale choice expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The examples explicitly show approval, stop, and cancel operations that can change execution state or terminate work without any caution, confirmation guidance, or role/authorization caveats. In a remote-control skill intended for phone/chat use, this increases the chance of accidental or socially engineered destructive actions because users may copy commands directly from examples.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The
cmd_tasks_deletefunction issues a DELETE request to/tasks/$1immediately, with no confirmation prompt, warning message, or other user-facing disclosure in the code path. Because deletion is an irreversible operation and the command name alone is not sufficient disclosure under this rule, this should warn or require confirmation before proceeding.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
SQP-3 applies to all file types and includes language or locale policy violations. The natural-language instructions in the README are written in Chinese only, with no indication that users may choose another language or that the repository is intentionally limited to a Chinese-speaking audience.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This is a markdown file, so SQP-2 applies to omissions in user-facing safety disclosures. The README lists actions that can modify or delete boards and cards and synchronize data with a backend, but it does not warn users about data loss, overwrites, or external data transfer implications.
- Content
Static analysis
Detected: suspicious.exposed_resource_identifier
Plaintext HTTP endpoint targets a CGNAT/Tailscale-range address.
Critical
- Code
- suspicious.exposed_resource_identifier
- Location
- examples.md:6