Security audit

daily-plan-orchestrator

Security checks for vulnerabilities and agentic risk

Overview

The skill performs the advertised daily scheduling work, but it also reads cross-tenant agent memory and automatically changes task priorities without clearly disclosing that behavior.

Review this skill before installing. It should only be used if you intend to grant it system-level PostgreSQL access that can read cross-tenant operational memory and change queued task priorities. Ask the publisher to document the agent_memory and task_execution_log reads, add tenant scoping or aggregate-only inputs, and gate the growth-priority feature behind explicit configuration.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares only tools [read, exec] while the metadata and described behavior imply access to environment variables (PG_DSN), filesystem/script execution, and network/database connectivity to PostgreSQL. This capability mismatch weakens policy enforcement and reviewability, making it easier for a powerful orchestration skill to access sensitive resources without explicit permission declarations.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The documented purpose is a bounded daily-plan generator, but the detected behavior expands into broader scheduling, notification, audit logging, and especially cross-tenant memory analysis and dynamic priority adjustment. That hidden scope increase is dangerous because reviewers and policy systems may approve the skill for low-risk plan generation while it actually processes additional sensitive data and can influence execution across tenants.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The orchestrator performs behavior outside its declared purpose by reading agent memory and execution logs to apply cross-cutting priority changes. This hidden scope expansion increases attack surface and can create unauthorized data use or operational side effects, especially when a scheduling component begins making system-wide optimization decisions.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code explicitly sets a system-wide tenant context and then reads cross-tenant agent_memory to influence scheduling. This bypasses tenant isolation expectations and can expose sensitive operational data across tenants or allow one tenant’s data to affect another tenant’s task priorities, which is a serious multi-tenant boundary violation.

Static analysis

No suspicious patterns detected.