任务规划器基础版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:35 AM UTC
• Version: 1.0.0

Overview

This appears to be a task-planning skill, but it requests broad command and file access while giving unclear and conflicting statements about network use and local-only data handling.

Review before installing. Use this only in a constrained environment where command execution, file writes, environment-variable access, and outbound network requests are limited. Do not provide callback URLs or API keys unless you understand what data may leave the machine, and avoid running the environment-variable check as written.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: SKILL.md:182

Finding

Security-Related Environment Variable Enumeration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 182–187
Vulnerability Type: Environment reconnaissance
Risk Level: Medium

bash

env | grep -E "API|KEY|TOKEN|SECRET" | sed "s/=.*/=***/"  # Linux/macOS
# Get-ChildItem Env: | Where-Object {$_.Name -match "API|KEY|TOKEN"} | Format-Table

Technical Analysis

The Skill instructs the Agent to enumerate environment variables whose names contain security-sensitive terms such as API, KEY, TOKEN, and SECRET. This behavior is unrelated to the core purpose of a task-planning Skill.

The Unix command masks values before displaying them, but it still reveals variable names and confirms which credentials or service integrations are present. The PowerShell command displays matching environment-variable objects in a table and does not explicitly redact their values, potentially resulting in direct credential disclosure depending on output formatting.

Because command output can enter the Agent context, execution logs, terminal history, or captured audit records, this instruction creates an unnecessary credential-discovery channel.

Attack Path

1. A user or automated workflow follows the configuration-verification instructions.
2. The Agent executes the applicable environment-enumeration command.
3. The command identifies environment variables associated with API keys, tokens, or secrets.
4. On Unix, credential names and their presence are disclosed even though values are masked.
5. On PowerShell, matching variable values may also be included in the formatted output.
6. The resulting information enters Agent-visible output or logs and may be exposed through later prompts, callbacks, logging, or compromised session context.

Impact Assessment

This issue can disclose the presence and names of credentials for unrelated services. In environments where the PowerShell output includes values, it may also disclose the credentials themselves.

Successful exploitation does not independentl ...[truncated 328 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove broad enumeration of environment variables matching generic secret-related terms.
2. Document only the exact environment-variable name required by the Skill.
3. Check whether that specific variable is defined without printing its value or name alongside unrelated variables.
4. Return only a Boolean configuration status, such as configured or not configured.
5. Avoid placing credential-related command output in Agent context, logs, caches, or execution reports.
6. If PowerShell validation remains necessary, access only the documented variable and suppress its value explicitly.
7. Apply least privilege by removing the exec capability if task planning can be implemented through structured local data operations alone.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:125

Finding

Unrestricted Callback Destination Conflicts with Local-Only Data Claims

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 125; related behavior at lines 194–199, 283, and 291
Vulnerability Type: Unvalidated outbound callback and inconsistent data-flow documentation
Risk Level: Medium

text

| callback_url | string | optional | Callback notification URL used after asynchronous processing completes |

Related documented behavior, translated into English:

text

The Agent will automatically:
1. Parse the natural-language instruction.
2. Invoke the corresponding tools or APIs.
3. Perform the operation and return the result.
4. Return the execution result for confirmation.

All FREE-version data is stored locally and is not uploaded to the cloud.

Network: Some functions require a network connection to access external APIs.

Technical Analysis

The input specification permits a caller to provide a callback_url, while the execution description states that the Agent may automatically invoke tools or APIs. The Skill does not define:

• Permitted URL schemes.
• Trusted destination hosts.
• Restrictions on private, loopback, link-local, or metadata-service addresses.
• The callback payload and whether task content is included.
• Redirect handling.
• Authentication requirements.
• Explicit user confirmation before transmission.

An arbitrary callback destination can therefore create an outbound data-exfiltration channel. If the Agent or its tools can issue HTTP requests from a trusted network, the callback may also operate as a server-side request forgery primitive against internal services.

The callback and external-API behavior also contradict the claim that all data remains local and is never uploaded. This inconsistency prevents users from making an informed decision about the confidentiality of task descriptions, notes, schedules, and execution metadata.

Attack Path

1. An attacker or untrusted input supplies a malicious callback_url.
2. The destination points to either an attacker-controlled ...[truncated 1280 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove callback support if it is unnecessary for the local task-planning functionality.
2. If callbacks are required, permit only HTTPS URLs.
3. Enforce a strict allowlist of trusted callback hosts and ports.
4. Resolve destination hostnames and reject loopback, private, link-local, multicast, reserved, and cloud metadata address ranges.
5. Revalidate the destination after DNS resolution and on every redirect; preferably disable redirects entirely.
6. Require explicit user confirmation before the first outbound callback to a destination.
7. Define a fixed, minimal callback schema that excludes task content, notes, credentials, environment data, and execution logs by default.
8. Authenticate callback requests without exposing reusable credentials in URLs or logs.
9. Apply outbound network restrictions so the Agent can communicate only with approved endpoints.
10. Update the privacy documentation to identify exactly what data may leave the local environment, why it is transmitted, and which service receives it.
11. Do not claim that data is never uploaded while callback or external-API functionality remains enabled.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill claims FREE-mode data is local-only and not uploaded, yet nearby sections document external API use, callback URLs, and network-dependent behavior. This mismatch can mislead users and agents into disclosing task data, metadata, or credentials to remote services under a false expectation of local-only processing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The top-level description presents the skill as a local-first personal task planner, but the document later permits external APIs and network operations beyond core planning. That inconsistency increases the risk that users or agents will authorize broader data exposure and tool use than expected for a simple local productivity skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

An overly broad trigger can cause the skill to activate during ordinary conversation, leading an agent to invoke read/write/exec tooling when the user only intended to discuss planning. In a skill with system-impacting capabilities, ambiguous activation increases the chance of unintended file changes, command execution, or data processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill states that the agent will automatically call tools or APIs and execute operations, while the metadata grants read, write, and exec capabilities. Without strong warnings, scoping, and confirmation, this creates a clear path for unintended command execution, file modification, or external requests triggered from routine user prompts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example phrase is generic enough to overlap with normal assistant requests, making accidental activation plausible. Because the skill has exec and write permissions, misrouting a benign conversation into this skill could produce unintended system actions or unnecessary data handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The configuration example hard-codes the timezone to 'Asia/Shanghai', and the file does not clearly present this as an example requiring user choice or locale opt-in. For a general-purpose task-planning skill, imposing a region-specific locale default in natural-language documentation can conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.