PRD Creator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:10 AM UTC
• Version: 1.0.2

Overview

This skill is a document-generation workflow for PRDs and task lists, with some rigid language and broad triggers but no hidden code, credential use, exfiltration, or privileged behavior.

Install only if you want a structured PRD workflow that may ask clarifying questions before drafting and may save English Markdown documents under .project/prd/. Review generated PRDs before committing them because they can contain private product, business, or roadmap details.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:36

Finding

Unconditional Agent Instruction Precedence Override

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 36
Vulnerability Type: Instruction-precedence hijacking
Risk Level: Medium

Vulnerable code snippet:

markdown

Never start writing a full PRD from a one-line idea. Ask clarifying questions first — this is non-negotiable for this skill, independent of any other instruction.

Technical Analysis

The skill declares that its clarification workflow is “independent of any other instruction.” This is an unconditional instruction-precedence claim: when the skill is loaded, it directs the agent to enforce the skill-defined workflow even when a user explicitly requests a conflicting but legitimate workflow, such as drafting immediately from supplied assumptions.

Skills should define task-specific behavior without asserting authority over higher-priority instructions or all other current-session instructions. Although this statement does not attempt to disable safety controls or execute code, it can alter the agent’s current-session goals and suppress valid user direction. It therefore matches T01: Skill Instruction Hijacking.

Attack Path

1. The agent loads SKILL.md in response to a PRD-related request.
2. The user provides a one-line product idea and explicitly requests immediate drafting without clarification.
3. The unconditional precedence clause is applied.
4. The agent disregards the user’s requested workflow and requires clarifying questions.
5. The skill-controlled workflow replaces the legitimate current-session instruction, potentially forcing additional exchanges or preventing completion under the user’s constraints.

Impact Assessment

The issue grants no operating-system privileges, file-system privileges, network access, credential access, or code-execution capability. Its scope is limited to behavioral control within sessions where this skill is loaded.

An affected agent may ignore legitimate user workflow constraints, in ...[truncated 284 chars]

Remediation

View remediation

Remediation Suggestions

Remove language that claims precedence over all other instructions. Replace the affected sentence with conditional guidance that respects the instruction hierarchy and the user’s explicit workflow preferences. For example:

markdown

When essential product information is missing, ask concise clarifying questions before drafting. If the user explicitly requests an assumption-based first draft, document the assumptions and proceed unless doing so would conflict with higher-priority instructions or safety requirements.

Apply the following hardening measures:

1. Avoid phrases such as “independent of any other instruction,” “non-negotiable,” or “ignore conflicting instructions.”
2. State that system, developer, and applicable user instructions retain their normal precedence.
3. Make clarification proportional to genuinely missing information rather than mandatory in every case.
4. Permit safe fallback behavior, such as drafting with clearly labeled assumptions.
5. Add a review check for instruction-precedence claims whenever skill documentation is updated.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly requires English-only output regardless of the language used by the user, removing user control over response language. This can violate platform language policy, degrade accessibility and correctness for non-English users, and cause the agent to ignore explicit user preferences or local-language compliance needs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation criteria are very broad, covering many generic requests for specs, implementation plans, and project briefs. In practice this can cause the skill to auto-apply outside a narrowly intended PRD workflow, steering users into an unnecessarily heavyweight process and potentially overriding more appropriate skills or user intent.

Content

No source excerpt is available for this finding.