Security audit

需求拆解

Security checks for vulnerabilities and agentic risk

Overview

This planning skill is not malicious, but it can automatically write sensitive planning output locally and publish or sync it to external tools when connectors are present.

Install only if you are comfortable with generated requirement documents being saved to disk, and with connected Linear, Jira, Notion, or Feishu workspaces receiving the generated content. Before using it with confidential roadmap, customer, architecture, or operational details, require a preview and explicit approval before any file save or external sync.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill’s declared purpose is analytical decomposition, but the instructions expand behavior into publishing artifacts and creating external tickets when connectors are present. This creates an action-capable pathway that can move user/project data outside the chat context without explicit confirmation, increasing the risk of unintended data disclosure or unauthorized task creation.

Description-Behavior Mismatch

Low

Confidence: 88% confidence
Finding: The instruction to save the complete output as a local Markdown file introduces a write side effect that is not clearly reflected in the skill’s analytical description. Even local writes can leak sensitive business requirements to disk unexpectedly, especially in shared or managed environments.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Automatically creating Linear or Jira issues expands the skill from planning into execution in external systems. This can expose internal project details, create unauthorized work items, and enable accidental or excessive propagation of user-supplied content into enterprise tracking platforms.

Context-Inappropriate Capability

Low

Confidence: 90% confidence
Finding: Publishing the generated decomposition document to Notion or Feishu extends the skill into external content distribution beyond its stated planning scope. That increases the chance of sensitive requirements, architecture details, or internal risks being shared to broader audiences or retained in third-party systems without user awareness.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs saving output to disk without a user-facing disclosure that content will be written locally. This is dangerous because business scenarios and implementation roadmaps may contain sensitive operational or strategic information, and silent persistence violates user expectations and can create retention/compliance issues.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill describes syncing user stories to Linear or Jira without warning that project data will be transmitted to external systems. This is risky because user input may include confidential roadmap, customer, or operational details that should not be exported automatically.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Publishing the full decomposition document to Notion or Feishu without an external-sharing warning can cause sensitive planning content to be broadly accessible or stored in third-party collaboration tools. The danger is elevated because the document may include architecture, dependencies, risks, and implementation sequencing that organizations often treat as confidential.

Static analysis

No suspicious patterns detected.