Generated by the improve skill on 2026-09-01 at commit 2d978f84. Execute in the order below unless dependencies say otherwise. Each executor must read its plan fully, honor STOP conditions, run every verification gate, and update its status row.
| Plan | Title | Priority | Effort | Depends on | Status |
|---|---|---|---|---|---|
| 001 | Pin privileged GitHub Actions dependencies | P1 | S | - | TODO |
| 002 | Require authentication on route-based MCP | P1 | M | 001 | TODO |
| 003 | Enforce shared-state exposure policy on direct MCP reads | P1 | S | 002 | TODO |
| 004 | Contain remote asset materialization | P1 | S | - | DONE |
| 005 | Block Data Inspector prototype-chain writes | P1 | S | - | DONE |
| 006 | Validate request-derived authentication-link origins | P1 | M | - | TODO |
| 007 | Reject pre-existing symlink escapes from filesystem roots | P2 | M | - | TODO |
Status values: TODO | IN PROGRESS | DONE | BLOCKED (with reason) | REJECTED (with rationale)
- Plan 001 lands first because the release path should stop following mutable privileged workflow code before security fixes are published.
- Plan 003 follows Plan 002 so MCP's read policy is tested behind the corrected identity boundary. It may be developed in parallel but should land immediately after Plan 002.
- Plans 004-007 are independent and can execute in separate worktrees. Each executor runs its plan's drift command before editing; only
plans/README.mdoverlaps.
- Dependency audit output reported critical/high advisories in
tar,postcss,sharp,svgo,brace-expansion, andnanoid, but review did not establish a reachable vulnerable runtime or distribution path. Reassess when dependency call paths or advisory conditions change. - Open Graph private-address fetching matches a tool whose purpose includes inspecting local development URLs; no separate private-network boundary is currently documented.
- Code-server workspace selection is an explicit tool input, so arbitrary folder selection alone was not treated as a containment bypass.
- Bearer-token expiration and static-token revocation behavior are lifecycle policy choices rather than implementation bypasses under the documented model.
- Executable asset formats share the user app's development trust boundary; the audit did not establish a distinct origin boundary that the current behavior violates.
This was a standard-effort, hotspot-weighted security audit of core RPC/auth/transports, hub browser boundaries, built-in devframes, framework kits, CI, starter, and representative examples. It did not audit correctness, performance, general test coverage, architecture, documentation quality, or product direction. Findings selected for plans were 1-6 plus the MCP shared-state dependency identified as finding 8.