team-planex

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill explicitly instructs sending entire workspace and session context (CONTEXT: @**/* and session wisdom) to external delegated agents (maestro delegate → codex/agy) and uses a message bus, creating a clear and intentional data-exfiltration capability; I found no obfuscated payloads, reverse shells, or explicit credential-stealing routines.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider free text can enter the LLM context via the planner’s runtime ingestion of issue details from ccw issue solution <issueId> --json (issue body/comments authored by non-operating users), which the planner then uses to generate solution JSON and subsequently feeds into executor prompts.