Security audit

Spm V4 Push

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its project-management purpose, but it gives agents broad repository-changing authority, including automatic commits and weak handling of risky shell commands.

Install only if you are comfortable with a project-management skill creating local tracking files and potentially guiding commits. Before use, require explicit approval for any git commit, force push, or shell command, and consider tightening the security policy so remote script execution is blocked rather than warned.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill instructs the agent to run shell commands such as mkdir, shasum, awk, cat, and date, but the skill metadata does not declare any permissions or clearly surface that shell execution is required. This creates a trust and review gap: users or policy systems may believe the skill is low-privilege when it can actually modify files and execute commands in the workspace.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The function name and documentation imply it returns a checkpoint heartbeat, but the implementation returns any heartbeat at or before the requested timestamp. Code that relies on this for recovery may resume from an in-progress or otherwise unsafe state, causing state corruption, incorrect task restoration, or bypass of checkpoint-based safety assumptions.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The file advertises a Merkle tree with tamper localization, but the implementation only hashes sorted leaf hashes into a single flat digest. Systems that rely on Merkle properties such as efficient inclusion proofs, branch verification, or localized recomputation may make incorrect security assumptions and fail to detect or reason about tampering as designed.

Vague Triggers

High

Confidence: 91% confidence
Finding: The activation criteria are very broad, triggering on common words like 'project', 'engineering', 'development', or any multi-step task. That can cause the skill to engage unexpectedly and start creating directories, ledgers, and executing shell-driven workflow steps in situations where the user did not clearly request this management framework.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The prompt explicitly instructs the subagent to run `git add -A && git commit ...`, which modifies repository history without any requirement for explicit user approval or a higher-level confirmation gate. In an agentic setting, this can cause unintended persistence of changes, commit unrelated files, and create audit or rollback problems, especially because `git add -A` stages all workspace modifications rather than only task-scoped files.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The doctor command performs a state-changing write to the event store and then rotates the domain as part of a health check, which modifies local project data during what users would reasonably expect to be a read-only diagnostic operation. In a project-management skill context, this is more dangerous because users may run health checks in production repositories or CI workspaces, causing audit noise, unexpected file churn, or accidental data loss/corruption if rotation has destructive semantics.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The transition rule allows movement from any phase to any other phase under the unconditional condition "always", effectively disabling lifecycle enforcement. In a project-management engine that orchestrates subagents and applies quality/security gates, this can let execution, delivery, or other privileged stages occur without required prerequisite review, validation, or approval.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: This hook automatically injects WBS ledger state into every downstream tool-call context, which can expose project structure, active work items, and task history to tools without explicit user awareness or consent. In an agent skill that orchestrates sub-agents and tools, this broad implicit propagation increases the chance of sensitive internal planning data being disclosed to external model/tool providers or used in unintended ways.

External Script Fetching

High

Category: Supply Chain
Content: reason: "Direct block device write" # ── Risky (warn user) ─────────────────────────────────────────────── - pattern: "^curl .*\\| sh$" level: risky action: warn reason: "Remote code execution via pipe to shell"
Confidence: 91% confidence
Finding: The policy explicitly classifies `curl ... | sh` as only `risky` with action `warn`, while the file's own semantics state that the first match wins and anything unmatched is `safe`. In an agent skill that may orchestrate shell commands, allowing remote script execution after only a warning materially weakens the security gate and can permit arbitrary code execution if the user approves or the warning is bypassed.

External Script Fetching

High

Category: Supply Chain
Content: action: warn reason: "Remote code execution via pipe to shell" - pattern: "^bash <\\(curl " level: risky action: warn reason: "Remote code execution via process substitution"
Confidence: 90% confidence
Finding: The rule for `bash <(curl ...)` also only warns instead of blocking, despite being a direct remote code execution primitive. In this project-manager/agent context, a weak allow-with-warning policy increases risk because automated or inattentive approval can lead to execution of untrusted fetched code.

External Script Fetching

High

Category: Supply Chain
Content: action: warn reason: "Overly permissive file permissions" - pattern: "^wget .* -O - \\| sh$" level: risky action: warn reason: "Remote code execution via pipe to shell"
Confidence: 91% confidence
Finding: The `wget ... -O - | sh` pattern is treated as warn-only, which leaves a well-known remote code execution path available. Because the policy defaults unmatched commands to `safe`, narrow warn-only patterns are especially dangerous in an agent that may execute shell commands on behalf of a user.

Unpinned Dependencies

Low

Category: Supply Chain
Content: "spm": "node src/cli.js" }, "dependencies": { "commander": "^15.0.0", "pino": "^10.3.1", "proper-lockfile": "^4.1.2", "yaml": "^2.9.0",
Confidence: 91% confidence
Finding: The dependency uses a caret range, which allows automatic installation of newer semver-compatible releases rather than a single exact version. In a security-sensitive agent skill, this weakens supply-chain reproducibility and can introduce malicious or vulnerable upstream updates without an explicit review.

Unpinned Dependencies

Low

Category: Supply Chain
Content: }, "dependencies": { "commander": "^15.0.0", "pino": "^10.3.1", "proper-lockfile": "^4.1.2", "yaml": "^2.9.0", "zod": "^4.4.3"
Confidence: 91% confidence
Finding: The pino dependency is specified with a caret range, so builds may resolve to different package contents over time. For an orchestration/CLI skill that may be installed in automation contexts, this increases supply-chain exposure and reduces reproducibility.

Unpinned Dependencies

Low

Category: Supply Chain
Content: "dependencies": { "commander": "^15.0.0", "pino": "^10.3.1", "proper-lockfile": "^4.1.2", "yaml": "^2.9.0", "zod": "^4.4.3" },
Confidence: 92% confidence
Finding: Using a non-exact version for proper-lockfile permits silent drift to later releases within the allowed range. Because this package affects file locking behavior, unexpected upstream changes could affect reliability or introduce supply-chain risk in environments that run the skill automatically.

Unpinned Dependencies

Low

Category: Supply Chain
Content: "commander": "^15.0.0", "pino": "^10.3.1", "proper-lockfile": "^4.1.2", "yaml": "^2.9.0", "zod": "^4.4.3" }, "devDependencies": {
Confidence: 93% confidence
Finding: The yaml dependency is not pinned to an exact version, allowing future compatible releases to be installed automatically. Since YAML parsers often process untrusted configuration input in agent systems, any compromised or vulnerable upstream release could have outsized impact compared with a purely cosmetic library.

Unpinned Dependencies

Low

Category: Supply Chain
Content: "pino": "^10.3.1", "proper-lockfile": "^4.1.2", "yaml": "^2.9.0", "zod": "^4.4.3" }, "devDependencies": { "jest": "^30.4.2"
Confidence: 90% confidence
Finding: The zod dependency uses a caret range, so installations are not fully deterministic across time or environments. While common in development, this still creates avoidable supply-chain risk for a production-oriented skill that emphasizes security and attestation.

Unpinned Dependencies

Low

Category: Supply Chain
Content: "zod": "^4.4.3" }, "devDependencies": { "jest": "^30.4.2" } }
Confidence: 87% confidence
Finding: The jest devDependency is also unpinned, which can lead to non-reproducible test environments and exposure to malicious or vulnerable updates during CI runs. Although this affects development rather than runtime directly, CI/CD compromise can still impact released artifacts.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: - pattern: "^rm -rf /" level: dangerous action: block - pattern: "^git push --force" level: risky action: warn - pattern: "^curl .*\\| sh$"
Confidence: 97% confidence
Finding: The security policy classifies 'git push --force' as merely risky and only warns, rather than blocking or tightly constraining it. In a project-management skill that may guide command execution, allowing force-push after warning can enable destructive history rewrites, loss of auditability, and overwriting collaborators' work.

Static analysis

No suspicious patterns detected.