Security audit

计划架构师

Security checks for vulnerabilities and agentic risk

Overview

This planning skill is not malicious, but it should be reviewed because it mixes planning-only language with command execution, API, and credential/network guidance.

Install only if you are comfortable granting this skill project-read and command-execution support for implementation planning. Treat generated commands, package installs, callback URLs, and any API-key requests as requiring explicit review before execution, and avoid providing credentials unless the workflow has a clearly stated service, scope, and data path.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill documentation gives conflicting statements about API key requirements, first claiming no extra API key is needed and later stating that some functionality does require one. In security-sensitive agent workflows, contradictory trust and credential guidance can cause operators to expose credentials unnecessarily or enable networked behavior they did not intend to permit.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The file labels the skill as 'pure methodology guidance' while nearby sections describe API integration and network communication behavior. This mismatch obscures the actual capability boundary of the skill and can lead users or orchestration systems to grant broader permissions than expected, increasing risk of unintended outbound access or data exposure.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The top-level description presents the skill as a planning assistant, but later content expands its scope to file handling, command execution, API integration, and network-related operations. Scope inflation like this is dangerous because users may invoke the skill under a low-risk assumption while it actually encourages higher-risk behaviors and tool use.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: Advertising external API integration for a plan-generation skill exceeds what is needed for its stated purpose and widens the attack surface without clear justification. Unnecessary external-service capability can enable data exfiltration paths, accidental credential use, or permission creep in agent environments.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The trigger keywords are broad and weakly bounded, making accidental activation more likely in unrelated conversations about planning, architecture, or engineering efficiency. In an agent system with exec/read/write-style tools, overbroad activation increases the chance that a higher-privilege skill is invoked without clear user intent.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill promotes saving plan files and running validation commands, but the main usage flow does not prominently warn users up front that file writes and command execution may occur. This is risky because users may treat the skill as documentation-only while it can induce side effects through tool use, especially in automated agent contexts.

Static analysis

No suspicious patterns detected.