Security audit

Trello Planner

Security checks for vulnerabilities and agentic risk

Overview

The skill is read-only and Trello-focused, but it asks for sensitive Trello credentials while using broad board enumeration, non-expiring token guidance, and several overstated or unsupported security/capability claims.

Install only if you are comfortable giving the skill read access to Trello data visible to the supplied token, including board names. Prefer a read-only token with the shortest practical expiration, avoid sharing full Trello URLs containing key or token values, pass an explicit board_id for sensitive workspaces, and treat the advertised optimization/search/capacity features as overstated unless the implementation is updated.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: skill.js:29
Finding: Trello credentials exposed through URL query parameters<![CDATA[ ## Vulnerability Details **File Location**: `skill.js:29-38` **Vulnerability Type**: Sensitive credentials in request URLs **Risk Level**: Medium ### Vulnerable Code ```js url.searchParams.set("key", auth.apiKey); url.searchParams.set("token", auth.token); for (const [k, v] of Object.entries(params)) { url.searchParams.set(k, v); } assertTrelloDomain(url); const res = await fetch(url.toString()); ``` ### Technical Analysis The implementation places the Trello API key and token in URL query parameters before serializing the complete URL for `fetch`. HTTPS encrypts the request in transit, and `assertTrelloDomain` limits the direct destination to `api.trello.com`. However, credentials in URLs can still be captured by infrastructure that records complete request URLs, including: - Server or proxy access logs - Runtime instrumentation and HTTP tracing - Observability and application-performance monitoring systems - Debugging tools - Exception or diagnostic telemetry The risk is increased because `SKILL.md` recommends creating a token with `expiration=never`. If such a token is disclosed, it remains useful until explicitly revoked. The network communication is necessary for the declared Trello functionality, and no transmission to an undeclared third-party host was found. The vulnerability concerns the credential transport mechanism rather than the legitimacy of the destination. ### Attack Path 1. A user configures the Skill with a valid Trello API key and read-scoped token. 2. `trelloFetch` adds both credentials to the request URL. 3. The serialized URL passes through a component that records complete request URLs. 4. An attacker or unauthorized operator gains access to those logs or traces. 5. The attacker extracts the API key and token. 6. The attacker submits authenticated requests directly to Trello and accesses resources authorized by the victim's token. This path requires access to request telemetry, logs, or another component that ca ...[truncated 583 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Use a Trello-supported authorization header or another mechanism that keeps credentials out of the URL, if available for the required API endpoints. 2. If Trello requires query-parameter authentication: - Ensure URL query strings are redacted from application, proxy, monitoring, and tracing logs. - Never include the complete request URL in errors or diagnostic output. - Disable or sanitize HTTP-client instrumentation that records query parameters. 3. Prefer tokens with limited scope and expiration over non-expiring tokens. 4. Document token rotation and immediate revocation procedures. 5. Add automated tests verifying that credentials never appear in application logs, returned errors, or telemetry. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: skill.js:38
Finding: Missing outbound request timeout contrary to documented security controls<![CDATA[ ## Vulnerability Details **File Location**: `skill.js:38`; security claim at `SKILL.md:100` **Vulnerability Type**: Unbounded outbound network request **Risk Level**: Low ### Vulnerable Code ```js assertTrelloDomain(url); const res = await fetch(url.toString()); if (!res.ok) { throw new Error(`HTTP ${res.status}`); } return res.json(); ``` The documentation claims the following control: ```text ✅ 12s timeout ``` ### Technical Analysis The `fetch` invocation does not provide an `AbortSignal`, `AbortController`, or other application-level timeout. Consequently, the documented 12-second timeout is not implemented. A request can remain pending according to the Node.js runtime and underlying network defaults if DNS resolution, connection establishment, TLS negotiation, or response delivery stalls. This can retain an execution slot and associated resources substantially longer than the documented limit. The destination is statically restricted to Trello, so an ordinary caller cannot redirect this function to an arbitrary slow host. Exploitation therefore depends on network disruption, an unresponsive upstream service, or repeated invocations during degraded Trello connectivity. ### Attack Path 1. A caller invokes the Skill with valid Trello credentials. 2. The Skill initiates a request to `api.trello.com`. 3. Trello or an intervening network component delays or stalls the connection or response. 4. Because no application-level timeout exists, the operation remains pending under runtime-level defaults. 5. Repeated or concurrent invocations accumulate pending operations. 6. Available execution slots, memory, sockets, or other runtime resources are consumed, degrading availability. ### Impact Assessment The primary impact is reduced availability of the Skill or its hosting agent. Under sufficient concurrency, stalled requests may exhaust execution capacity or network resources. This issue does not directly grant additional privileges, expose ...[truncated 52 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Enforce the documented 12-second limit using `AbortSignal.timeout` where supported: ```js const res = await fetch(url.toString(), { signal: AbortSignal.timeout(12_000) }); ``` 2. For runtimes without `AbortSignal.timeout`, use an `AbortController` and always clear its timer in a `finally` block. 3. Map timeout failures to a distinct error type rather than reporting all such failures as generic network errors. 4. Apply the timeout to both connection establishment and response-body processing. 5. Add automated tests using a deliberately stalled endpoint or mocked `fetch` implementation to confirm that requests are aborted within the configured limit. 6. Consider bounded retries with exponential backoff and jitter, while enforcing an overall operation deadline. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is not doing anything obviously unsafe or write-capable, and it remains within Trello’s API using read-only style access. However, the declared description overstates and partly misstates the actual behavior. The implementation’s primary behavior is a narrow board-health check: list accessible boards via /members/me/boards, select one board, fetch its cards, count open and overdue cards, and return a basic insight/health score. That differs materially from the declared coverage of lists/cards/members via /boards/{id}/*, cross-board search, and richer planning features like sprint capacity and optimization. Additionally, it accesses a resource outside the declared endpoint list (/members/me/boards).

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares network-dependent behavior and requires API credentials, but does not define an explicit tool scope such as allowed-tools or permissions. That creates an authorization ambiguity where a user-invocable skill may be granted broader runtime capabilities than intended, increasing the chance of unintended outbound requests or future abuse if the implementation changes.

External Transmission

Medium

Category: Data Exfiltration
Content: ``` 1. https://trello.com/app-key → API Key 2. https://trello.com/1/authorize?key=[YOUR_KEY]&name=TrelloPlanner&scope=read&expiration=never → Token 3. Test: https://api.trello.com/1/members/me/boards?key=[KEY]&token=[TOKEN] ``` ## Verified Endpoints (Boards Group)
Confidence: 84% confidence
Finding: The skill includes a test URL that embeds the API key and token in a query string. Even though this targets the legitimate Trello API, placing secrets in URLs is dangerous because they can leak via browser history, logs, screenshots, proxies, referrers, or copied command output.

External Transmission

Medium

Category: Data Exfiltration
Content: * - No credential logging or persistence */ const TRELLO_API_BASE = "https://api.trello.com/1"; const TRELLO_DOMAIN = "api.trello.com"; /**
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill metadata says it is limited to board read endpoints under /boards/{id}/*, but the implementation also calls /members/me/boards to enumerate all boards available to the authenticated user. This creates a scope/behavior mismatch that can expose additional account-level metadata and undermine user trust and permission review.

Scope Creep

Medium

Confidence: 94% confidence
Finding: The code accesses member-scoped board listing data beyond the endpoints described in the skill metadata, which states only /boards/{id}/lists, /cards, and /members are used. Even though the Trello token is read-only, enumerating a user's boards reveals additional organizational and project information not clearly disclosed by the skill contract.

Vague Triggers

Low

Confidence: 84% confidence
Finding: The skill is user-invocable via slash commands but does not clearly constrain what inputs, targets, or operating scope are permitted. In practice, underspecified invocation scope can cause the agent to act on ambiguous user requests, fetch broader board data than expected, or mishandle sensitive workspace context.

Static analysis

No suspicious patterns detected.