Security audit

Lobster Dev Planner

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed development-planning assistant, but it tells agents to automatically use broad repository, database, deployment, and notification tools after development starts without tight scoping or per-action approval.

Install only if you want a Chinese-language, highly automated development orchestrator and are prepared to supervise it closely. Before use, restrict connected GitHub, database, deployment, filesystem, and notification credentials to disposable or project-specific resources, require review before commits, pushes, SQL writes, deployments, and messages, and replace weak example credentials in generated documentation.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:254
Finding: Automatic Use of Broad Repository, Database, and Notification Permissions
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:254-288, SKILL.md:361-363; supporting directives in references/plan-template.md:32-33
Vulnerability Type: Excessive automatic tool permissions and insufficient operation-level authorization
Risk Level: Medium

Evidence

The following is an English translation of the relevant Skill directives:

text
SKILL.md:254 This must be performed before development. Automatically scan available tools and establish an invocation plan. SKILL.md:265 PostgreSQL/MySQL/SQLite MCP preferred: execute SQL directly. SKILL.md:278 Slack/Email MCP, if available: send development progress. SKILL.md:281-288 Toolchain configuration completed: Available: [available MCP list] Fallback: [alternative when MCP is unavailable] Invoke tools automatically throughout the process without manual operation. SKILL.md:361-363 MCP tool authorization: GitHub MCP with commit permission Database MCP with read/write permission references/plan-template.md:32-33 GitHub MCP: automatically commit, push, and create Issues. Database MCP: execute SQL directly.

Technical Analysis

The Skill directs the agent to discover integrations automatically and use them throughout development without manual intervention. It also assigns repository commit capabilities and database read/write capabilities to subordinate agents.

These permissions are not constrained to a named repository, branch, database, schema, operation set, or recipient list. The instructions do not require:

Per-operation approval for commits, pushes, SQL writes, deployments, or notifications.

Protected branches or pull-request review before remote changes.

Read-only database access by default.

SQL dry runs, transactions, backups, or destructive-query checks.

Recipient allowlists and content redaction for Slack or email.

Validation of instructions derived from project files or other untrus ...[truncated 1792 chars]
Remediation: View remediation
Remediation Suggestions

Require explicit confirmation immediately before every external write operation, including:

Database writes and schema changes.

Repository commits and pushes.

Issue or pull-request creation.

Deployment operations.

Slack or email delivery.

Enforce least privilege:

Bind GitHub credentials to a specific repository.

Permit pushes only to a dedicated feature branch.

Require pull-request review before merging.

Use read-only database credentials unless a narrowly defined write task is approved.

Restrict database access to the required schema and operation set.

Add database safeguards:

Display generated SQL before execution.

Use transactions and automatic rollback on failure.

Require additional confirmation for DROP, TRUNCATE, unrestricted DELETE, and destructive migrations.

Create and verify backups before schema changes.

Prefer migration files reviewed through version control over direct production SQL.

Treat repository files, web results, generated documents, and third-party content as untrusted data. Do not allow instructions found in such content to expand tool permissions.

Restrict notifications to approved recipients and redact secrets, source code, database records, environment variables, and internal error details.

Record immutable audit logs containing the requesting identity, target resource, proposed operation, approval decision, and result.

T09 · Insecure Skill Coding Practices

Note

Location: references/dev-doc-template.md:213
Finding: Weak Privileged Database Credential in a Copyable Configuration Example
Content: View full analysis
Vulnerability Details

File Location: references/dev-doc-template.md:213-215
Vulnerability Type: Insecure credential example
Risk Level: Low

Evidence

The following is an English translation of the surrounding comments while preserving the configuration values:

bash
DATABASE_URL="postgresql://username:password@localhost:5432/database_name" # Format: postgresql://USER:PASSWORD@HOST:PORT/DBNAME # Example: postgresql://admin:123456@localhost:5432/myapp

Technical Analysis

The development-document template provides a copyable database connection string using the account name admin and the trivial password 123456. Although this is presented as an example rather than a live secret, generated setup documentation is commonly copied into local, test, or production configuration.

The use of a privileged-looking account name increases the potential impact. If the example is retained and the database becomes reachable beyond a trusted local boundary, an attacker can attempt the documented credentials without needing to discover or crack a strong password.

Attack Path

The Skill generates a development document from the template.

A developer copies the sample database URL into an environment file or deployment configuration.

The developer retains the admin:123456 credential or creates a database account with equivalent weak credentials.

The database is exposed through a container port, cloud security-group rule, network misconfiguration, or compromised application host.

An attacker authenticates using the predictable example credentials.

The attacker accesses or modifies data according to the privileges assigned to the admin account.

Impact Assessment

If copied unchanged, the example may enable unauthorized database authentication. The resulting privileges depend on the configured account, but a database account named admin may have broad rights. Potential im ...[truncated 408 chars]
Remediation: View remediation
Remediation Suggestions

Remove the fixed password and privileged-looking username from the example.

Use unmistakable placeholders, for example:

bash
DATABASE_URL="postgresql://APP_USER:GENERATED_PASSWORD@localhost:5432/APP_DATABASE"

Direct users to generate a random password with a cryptographically secure password generator.

State explicitly that example credentials must never be used unchanged in any environment.

Recommend a dedicated, non-administrative application account with only the permissions required by the application.

Store the resulting secret in an approved secret manager or protected environment configuration rather than source control.

Add automated secret and weak-credential checks to generated-project validation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger conditions are extremely broad, including vague phrases like wanting to 'make something', which can cause the skill to activate during ordinary conversations not intended to authorize software development or tool orchestration. In this skill’s context, accidental activation is especially dangerous because later phases authorize planning for repository, database, deployment, and agent-driven execution workflows, increasing the risk of unintended sensitive actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This section describes automatic detection and use of file, repository, database, deployment, web, and notification tools, including direct SQL execution, repository operations, and deployment actions, but does not present a clear user-facing warning or consent boundary. In a skill designed to orchestrate MCP tools end-to-end, omission of explicit disclosure materially increases the chance that users will unknowingly permit destructive, external, or irreversible operations.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/dev-doc-template.md (reported line 275)May include surrounding context.
md
npm install # 3. 配置环境变量 cp .env.example .env # 用编辑器打开 .env 文件，填写上面的配置 # 4. 初始化数据库

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/dev-doc-template.md (reported line 276)May include surrounding context.
md
# 3. 配置环境变量 cp .env.example .env # 用编辑器打开 .env 文件，填写上面的配置 # 4. 初始化数据库 npm run db:migrate # 执行数据库迁移

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/dev-doc-template.md (reported line 308)May include surrounding context.
md
# 3. 配置环境变量 cp .env.example .env # 用编辑器打开 .env 文件，填写上面的配置 # 4. 初始化数据库 npm run db:migrate # 执行数据库迁移

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill defines automatic parallel agent development, delegated task execution, MCP-authorized commits, database writes, and continuous progression between nodes, yet it does not require explicit user review before those agents perform changes. Because the workflow is framed as automatic and ongoing, a user may lose meaningful control over code generation, commits, tests, and downstream side effects, amplifying the blast radius of mistakes or misuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The final delivery section explicitly requires listing “所有中文提交记录”, which imposes a specific language convention. The skill does not provide user opt-in, multilingual choice, or a documented reason that the skill is intended only for a Chinese-language environment.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-doc-template.md (reported line 279)May include surrounding context.
bash
# 注册 curl -X POST http://localhost:3000/api/v1/auth/register \ -H "Content-Type: application/json" \ -d '{"username":"test","email":"test@example.com","password":"Abc123456","confirmPassword":"Abc123456"}'

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file title and instructions are written as a Chinese-only development document template, and nowhere indicates that another language may be used. This creates a language/locale policy concern because it imposes a specific language by default without user opt-in or a documented region-specific justification.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 60% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · references/dev-doc-template.md (reported line 213)May include surrounding context.
md
# 服务配置 # ================================ PORT=3000 # 服务监听端口（必填） NODE_ENV=development # 环境：development / production（必填） # ================================ # 数据库配置

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown template is written entirely in Chinese and includes Chinese-only examples and labels, which imposes a specific language/locale on users of the skill content. The file does not offer an opt-in language choice or explain that the template is intended only for a Chinese-language team or region-specific context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown template forces a specific language/locale in its natural-language content without any user opt-in or indication that it is intentionally region-specific. The stated policy flags language or locale constraints unless the file offers a choice or clearly documents a justified regional scope.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/api-doc-template.md:29

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Evidence

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Evidence

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Vague Triggers

Missing User Warnings

Credential Access

Credential Access

Credential Access

Missing User Warnings

Natural-Language Policy Violations

External Transmission

Natural-Language Policy Violations

Unsafe Defaults

Natural-Language Policy Violations

Natural-Language Policy Violations

Static analysis

File appears to expose a hardcoded API secret or token.