Security audit

Web3 PM Interview Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only Web3 product-manager interview prep skill with no hidden code or persistence, though users should redact private career details and avoid real-value wallet practice.

Before installing, treat this as an interview-coaching knowledge pack. Do not paste raw recordings, private recruiter messages, compensation details, non-public company information, named interviewer analysis, or unnecessary personal data. For wallet practice, use testnets or burner wallets with trivial funds and avoid exposing seed phrases or private keys.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 70% confidence
Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
md
*(注：若目前这些文件内容为空，建议先写好基础框架再开源，否则 AI 缺乏知识支撑)。* #### 4. `SKILL.md` * 非常完美，基本不需要大改。建议在 `## First Response Pattern` 之前加一句：“Always respond in the language the user uses to initiate the conversation.” (支持用户用任意语言发起对话)。 #### 5. `examples/anonymized-wallet-senior-pm-case.md` (新增) * **强烈建议补充一个真实的“Mock 输出”：** 把你用这个 Skill 跑出的最好的一次 Battle Plan 保存下来，脱敏后放在这里。这就像是 SaaS 产品的 Landing Page，用户看一眼就知道自己能得到什么。

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 70% confidence
Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
Content: Scanner excerpt · reports/glm-test-report-raw.md (reported line 86)May include surrounding context.
md
*(注：若目前这些文件内容为空，建议先写好基础框架再开源，否则 AI 缺乏知识支撑)。* #### 4. `SKILL.md` * 非常完美，基本不需要大改。建议在 `## First Response Pattern` 之前加一句：“Always respond in the language the user uses to initiate the conversation.” (支持用户用任意语言发起对话)。 #### 5. `examples/anonymized-wallet-senior-pm-case.md` (新增) * **强烈建议补充一个真实的“Mock 输出”：** 把你用这个 Skill 跑出的最好的一次 Battle Plan 保存下来，脱敏后放在这里。这就像是 SaaS 产品的 Landing Page，用户看一眼就知道自己能得到什么。

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The launch copy explicitly encourages users to feed resumes and job descriptions into AI, but it does not warn about personal data, confidential employer information, or the need to redact sensitive details first. In this skill context, that omission is meaningful because resumes and JDs commonly contain PII, contact information, employment history, and potentially non-public hiring details that could be exposed to third-party AI systems or logs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs users to 'use 3 wallets and complete send, swap, bridge, approve, revoke' as interview preparation without any safety guidance, testnet recommendation, or warning that these actions can incur real fees, trigger approvals, expose funds, or cause irreversible loss. In a wallet-focused Web3 context, this omission is materially risky because novices are especially likely to perform these actions on mainnet or with meaningful assets while still learning unfamiliar transaction mechanics.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file explicitly includes an 'english_level' intake field and later labels 'English risk' as a hiring concern based on ability to operate in global organization meetings. In an interview-prep skill, this can steer evaluation toward language-based screening without user opt-in, role-specific necessity, or regional/legal justification, creating bias and potential discriminatory treatment.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The invocation conditions are broad enough to match ordinary user requests like asking if an answer is good enough or providing a transcript, which can cause this skill to activate outside narrowly intended interview-scoring contexts. Overbroad triggering is dangerous because it can lead to inappropriate context capture, irrelevant instruction injection into unrelated conversations, or accidental override of a more suitable skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 66% confidence
Finding: The file describes the skill as bilingual and later provides substantial Chinese-language content, but it does not explicitly state that language output is user-selectable. Because policy requires avoiding forced language or locale behavior without opt-in, this could be interpreted as an undocumented language constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Line L07 requires README.md to explain content in English and Chinese, which is a natural-language locale requirement. The file does not indicate that this bilingual requirement is optional or justified by a clearly region-specific constraint, so it may conflict with language-choice policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The file presents a full Chinese-language section in addition to English, but does not state whether language selection is optional or user-driven. Under the policy rule, imposing a specific language or locale without opt-in can be a natural-language policy concern, even if the intent is bilingual accessibility.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The tagline specifies the skill as "Bilingual" but does not indicate that language use is optional, user-selectable, or limited to a justified regional context. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Line L110 instructs the reader to 'Prepare English versions of core stories,' which imposes a language requirement in natural language. Because the file does not indicate this is optional, user-selected, or justified by a clearly documented role requirement, it may violate the language/locale policy constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file is entirely written in Chinese, and nowhere indicates that the skill or review is intentionally limited to Chinese-speaking users or that an English alternative is available. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file contains a natural-language recommendation: "Always respond in the language the user uses to initiate the conversation." That prescribes a locale/language behavior without explicitly offering user choice, which falls under the language policy check for natural-language policy violations.
Content: No source excerpt is available for this finding.