PRD Engine

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:31 PM UTC
• Version: 1.0.0

Overview

This is a PRD-writing methodology skill with disclosed templates; the main caution is to review generated agent commands before running them.

Installers should treat this as a documentation and planning aid. Before letting an agent run commands generated from its templates, confirm package versions, prefer project-local locked scripts, and review any database migration target, backup, and rollback plan.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:324

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 324–325
Vulnerability Type: Unsafe resolution and execution of an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

markdown

- "Generate migration: `npx drizzle-kit generate`"
- "Run migration: `npx drizzle-kit push`"

The same commands are repeated in SKILL.md at lines 332–333 and documented again at lines 381–382.

Technical Analysis

The skill instructs AI coding agents to invoke drizzle-kit through npx without specifying a package version, requiring a lockfile-pinned local dependency, validating package provenance, or using --no-install.

If drizzle-kit is not already installed in the target project, npx may resolve and download a package from the configured package registry before executing its code. This makes the effective executable dependent on mutable registry state and local package-manager configuration rather than solely on content reviewed with the skill.

A compromised package release, registry configuration, dependency-resolution event, or similarly unsafe supply-chain condition could therefore cause arbitrary package code to run with the coding agent's operating-system privileges. Separately, drizzle-kit push applies schema changes directly to the configured database and may cause unintended modification when the environment or connection target has not been reviewed.

No evidence was found that this project itself supplies a malicious package or deliberately configures a hostile registry. The risk arises from prescribing unpinned dynamic dependency execution.

Attack Path

1. A user asks the skill to produce an agent-ready PRD for a project using Drizzle ORM.
2. Following the template, the generated story includes npx drizzle-kit generate and npx drizzle-kit push.
3. An AI coding agent executes these verification or migration commands.
4. If the package is unavailable locally, npx dynamically resolves and may ...[truncated 1067 chars]

Remediation

View remediation

Remediation Suggestions

1. Add drizzle-kit as an explicitly versioned development dependency and commit the package manifest and lockfile.
2. Execute only the lockfile-resolved local binary, preferably through a reviewed package-manager script.
3. If npx remains necessary, use npx --no-install drizzle-kit ... so execution fails rather than downloading an undeclared package.
4. Require immutable or tightly constrained dependency versions and verify package provenance and integrity during installation.
5. Run dependency installation with lifecycle scripts disabled where practical, enabling required scripts only after review.
6. Separate migration generation from migration application. Require human review of generated SQL before applying it.
7. Do not prescribe drizzle-kit push as a universal verification step. Require explicit confirmation of the target environment and database before execution.
8. Use least-privilege database credentials, prohibit production targets by default, and provide tested backup and rollback procedures.
9. Execute package and migration tooling in an isolated environment with restricted filesystem, secret, and network access.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The quick-start phrases are generic natural-language prompts such as 'Write a PRD for [feature name]' and 'Break this into stories', which are likely to overlap with ordinary user requests. Without explicit activation constraints, scoping rules, or confirmation gates, the skill may trigger unintentionally and steer unrelated conversations into its methodology or outputs. In this context the content is not directly code-executing or data-exfiltrating, but it can still cause prompt hijacking of user intent and unreliable agent behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The quick-command invocations include very generic phrases such as "Review this PRD," "What's missing from this PRD?" and "Track progress" without any stated activation constraints or exclusion conditions. In a markdown skill description, these broad natural-language triggers can cause unintended invocation because they resemble ordinary conversational requests rather than narrowly scoped commands.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.