Reddit Demand Sniffer & MVP Engine

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:50 AM UTC
• Version: 1.0.0

Overview

This is a text-only MVP research skill that uses Reddit-oriented guidance and templates, with no evidence of hidden code execution, persistence, credential use, or automatic posting.

Install this skill if you want Chinese-language, Reddit-based MVP research guidance. Review subreddit rules before using its posting templates, do not auto-post generated content without human review, and add privacy/consent checks before following its analytics or session-recording recommendations.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The description is written only in Chinese and implies a fixed Chinese-language presentation without offering language negotiation, which can cause incorrect routing or unusable outputs for users operating in other languages. This is primarily a quality and accessibility issue that may lead to misunderstanding of scope or outputs, rather than a classic security flaw, but it can still degrade safe and accurate system behavior.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger conditions are broad enough to match many ordinary product, startup, and idea-validation requests, which can cause the skill to activate when the user did not specifically ask for Reddit-based MVP research. Over-broad activation can misroute conversations, bias the assistant toward unnecessary web/research workflows, and reduce user control over tool or skill selection, but it does not create direct code-execution or data-exfiltration risk.

Natural-Language Policy Violations

Medium

• Confidence: 85% confidence
• Finding: This markdown file presents its operative guidance and section structure in Chinese, effectively requiring Chinese comprehension to use the skill material. The file does not offer an alternative language option or explain that the skill is intentionally region- or language-specific, which can violate language/locale choice expectations.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This markdown file presents its headings, instructions, and templates entirely in Chinese, with no indication that the user can choose another language. The policy explicitly calls for flagging language or locale constraints when they are imposed without user opt-in or justification.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document recommends Google Analytics, Mixpanel/Amplitude, and Hotjar-style session recording as default data collection methods without any privacy, consent, minimization, or retention guidance. In a skill focused on rapidly shipping MVPs, this omission can lead builders to deploy invasive tracking or session replay in ways that expose user behavior and potentially personal data without adequate notice or lawful basis.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown file presents all headings, instructions, and analysis guidance in Chinese, which effectively forces a specific language for users. The policy allows locale constraints only when users are given a choice or when the constraint is clearly documented and justified, neither of which appears here.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The file forces a single language for all instructions and headings, and there is no indication that the skill is region-specific or that users can opt into Chinese. Under the stated policy, natural-language content that imposes a specific language without user choice can be a locale-policy violation.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This markdown file is natural-language guidance and appears entirely in Chinese, beginning with the table of contents and continuing through the whole document. Under the policy, forcing a specific language without user opt-in can be a language/locale policy violation when no choice or justification is provided.

Static analysis

No suspicious patterns detected.