Security audit

reqplan-v3

Security checks across malware telemetry and agentic risk

Overview

This skill is a legitimate software workflow tool, but it can auto-activate on broad phrases and create persistent project files before clear user consent.

Review before installing. Use it only in repositories where you are comfortable with automatic creation of .agent/harness and docs/harness files, possible source-code changes, and verification commands that may install dependencies. Prefer invoking it explicitly with /reqplan, keep the workspace under version control, and avoid using it on projects containing secrets or sensitive customer data unless you first confirm what it will write.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The guide repeatedly frames verification and quality gates as mandatory, blocking checkpoints, but later allows a downgraded path that can skip unit tests at user request. That contradiction weakens the control model and can be exploited to push unverified code through the workflow under the appearance of compliance, increasing the likelihood of insecure or broken changes reaching later stages.

Vague Triggers

High

Confidence: 96% confidence
Finding: The activation keywords include broad conversational phrases such as planning-oriented language that can appear in many benign requests, making unintended invocation likely. In this skill, accidental activation is more dangerous because the skill is designed to read and write project files and to autonomously progress through multi-stage workflows, so a false trigger can lead to unnecessary repository changes or state-file creation.

Vague Triggers

High

Confidence: 97% confidence
Finding: The intent regex patterns are highly permissive, matching common phrases like "分析.*", "检查.*", or "开发.*" without sufficient disambiguation. Because the skill auto-runs a state machine and has write permissions, ambiguous matching can cause the agent to enter an invasive development workflow when the user may have intended only a lightweight discussion or review.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The manifest requests write access to project files and document creation, but the skill description does not present a clear user-facing warning that activation may modify repository contents. In this context, the risk is amplified because the skill produces multiple runtime and archive artifacts by design, so users may unknowingly trigger persistent changes simply by asking for analysis or planning help.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill's activation criteria are broad enough to match common requests, increasing the chance the workflow hijacks normal interactions and applies an intrusive multi-step process unexpectedly. In an agentic system, overbroad activation is a security and safety issue because it can cause unintended file reads, state transitions, and persistent artifact creation outside the user's actual intent.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The checklist includes generic phrases like '怎么做', '下一步做什么', and '帮我规划一下', which are common in ordinary conversation and not specific to software project orchestration. This creates an elevated risk of accidental activation, causing the agent to enter a stateful workflow and potentially operate on project files or internal harness artifacts without sufficiently precise user authorization.

Vague Triggers

Low

Confidence: 90% confidence
Finding: Using broad phrases like '帮我看看' for intent classification can misclassify unrelated requests as analysis tasks. In this skill, that matters because activation leads to a structured state machine with file-based outputs, so even a low-specificity phrase can unnecessarily expand the agent's behavior and access pattern.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to create directories and initialize repository files when they are missing, but it does not require a clear user-facing warning or consent before making persistent filesystem changes. In an agent setting, this can cause unintended repository modification, surprising side effects, and abuse when an attacker frames a task to trigger writes outside the user's expected scope.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The analysis flow persists review artifacts into the repository, but the skill does not clearly tell the user beforehand that running an analysis may create new files under docs/harness/reviews. This is risky because even read-oriented tasks can silently become write operations, which may pollute the repo or be leveraged to plant misleading artifacts.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The fix flow stores diagnostic records in project files without an explicit warning that troubleshooting will write persistent artifacts to the repository. This can create unexpected changes during a debugging session and may expose sensitive operational details if diagnostic records are committed or shared.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs agents to leave persistent, traceable project records after each task, but provides no safeguards about excluding secrets, personal data, credentials, incident details, or other sensitive content. In a software-engineering workflow, these records can easily accumulate proprietary code context, bug details, customer identifiers, or security-relevant artifacts, creating unnecessary long-term data exposure.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The file defines docs/harness/history.yaml and other locations as permanent archives and says task records should be permanently appended, but it does not require any user notice, consent, retention control, or sensitivity review. This can lead to silent long-term retention of internal project history, bug reports, implementation details, and possibly regulated or confidential information far beyond what is operationally necessary.

Vague Triggers

High

Confidence: 94% confidence
Finding: The activation phrases are extremely broad and include common verbs like '分析', '修复', '写个', and '怎么做', which can match many ordinary conversations that do not warrant invoking a file-writing autonomous workflow. In this skill, unintended activation is especially risky because activation immediately triggers state-machine execution, baton reads/writes, and continued autonomous progression across phases.

Vague Triggers

High

Confidence: 95% confidence
Finding: The natural-language trigger table contains generic one-word triggers such as '写', '修', '改', '分析', and '测试', which are too ambiguous to safely control a powerful autonomous skill. Because the skill self-binds, auto-runs, and persists artifacts, accidental invocation could cause unwanted file operations and workflow lock-in even when the user intended a simple discussion.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill mandates immediate execution, baton initialization, and ongoing writes under '.agent/harness/' upon activation, but it does not require an up-front user consent notice at the moment those side effects begin. This creates a consent and integrity risk: users may unknowingly trigger filesystem changes simply by expressing a broad development-related intent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to create directories automatically when the project path does not exist, without requiring user confirmation or a safety check on the path. In an agentic environment, this can lead to unauthorized filesystem mutation, path misuse, or accidental creation of files/directories in unintended locations, especially when the provided project path is wrong, attacker-controlled, or ambiguous.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill recommends system-changing commands such as pip install -r requirements.txt and build/install steps without requiring user confirmation, isolation, or sandboxing. In an agentic setting, dependency installation can execute arbitrary code through package hooks or alter the host environment, making this materially riskier than a passive documentation example.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The protocol repeatedly instructs the agent to create and update persistent files inside the target project as a mandatory behavior, but it does not require explicit user consent, scope limitation, or a safety warning before modifying the workspace. In an agent skill, this can lead to unauthorized file creation or state persistence in repositories the user only intended to inspect, increasing the risk of unintended changes and trust-boundary violations.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:203