DevRel & Developer Advocacy Engine

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:34 PM UTC
• Version: 1.0.0

Overview

This skill is a DevRel strategy playbook made of markdown templates and does not request sensitive access, persistence, or automatic execution.

Install only if you want your agent to give structured DevRel and developer advocacy advice. Use explicit skill invocation to avoid accidental activation, and avoid sharing private business metrics, community data, or unpublished strategy unless you intend the agent to use that context.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The phrase `Create DevRel strategy` is an especially broad full-skill trigger that maps to a large portion of ordinary business language. Because it invokes the full multi-phase workflow, accidental activation could significantly misroute agent behavior, override a more appropriate tool, or consume unrelated user context at greater scope than narrower commands.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrase `Audit our DX` is broad and likely to overlap with ordinary user requests about developer experience. This can cause unintended invocation of the skill in contexts where the user did not explicitly request this specific DevRel workflow, leading to prompt-routing errors or inappropriate context capture.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrase `Plan conference strategy` is ambiguous and can match common planning language unrelated to this skill. In agent ecosystems, ambiguous triggers increase the chance of accidental activation, causing the wrong capability to engage and potentially exposing unrelated conversation context to the skill.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The phrase `Design SDK roadmap` is generic and likely to occur in routine product or engineering discussions. Because it lacks boundaries or namespacing, it may unintentionally invoke the skill and steer the assistant into a structured workflow the user did not mean to trigger.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger `Open source strategy` is underspecified and overlaps with a very common topic area. This creates a realistic risk of accidental skill activation during normal advisory conversations, which can degrade reliability and result in contextually inappropriate outputs.

Static analysis

No suspicious patterns detected.