Security audit

任务规划器基础版

Security checks for vulnerabilities and agentic risk

Overview

This task-planning skill is not overtly harmful, but its local-only privacy claims conflict with its network, callback, API key, and exec/write instructions.

Review before installing. This appears to be a generic task planner rather than malware, but users should treat it as capable of local file changes, command execution, network calls, callbacks, and API key handling despite the local-only privacy language. Avoid using it with sensitive project data unless network/API behavior and write/exec confirmations are clarified.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest markets the skill as 'local-first' and implies local data handling, but the document also allows callback URLs, external APIs, and network-dependent behavior elsewhere. This creates a misleading trust boundary: users may provide sensitive task data believing it never leaves the machine when the agent may in fact transmit it externally.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The FAQ claims FREE edition data is stored locally and 'not uploaded to the cloud,' but other sections require network connectivity, external APIs, and optional callback URLs. This contradiction can cause users to expose sensitive project plans, notes, deadlines, or credentials under false privacy assurances, making the issue more severe than a generic documentation inconsistency.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The skill says users can trigger actions via natural-language instructions without defining clear activation boundaries, exclusions, or confirmation requirements. In an agent environment with read/write/exec tools, broad trigger wording increases the chance that ordinary conversation or ambiguous requests cause unintended file changes, command execution, or outbound requests.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The example trigger phrase '请帮我拆解复杂项目' is so generic that it could overlap with normal conversation rather than an intentional request to activate a privileged skill. In contexts where the skill has exec/write capability, overly broad examples normalize unsafe invocation and can lead to accidental execution flows.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation states that the agent will call tools or APIs and execute operations, but it does not clearly warn users that this may involve file writes, shell execution, or remote transmission. Because the skill declares read, write, and exec capabilities, the absence of explicit warnings and consent steps weakens informed user control and raises misuse risk.

Static analysis

No suspicious patterns detected.