Security audit

pm-workbench

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent product-management workbench with local documentation validation, and I found no hidden execution, credential use, network access, persistence, or destructive behavior.

Before installing, treat this as a PM advice and artifact-generation skill, not an automation tool. It does not appear to request sensitive access, but the maintainer should fix the missing README image assets because the documented validation command fails in the inspected artifact.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (41)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for a product strategy/workbench skill that helps users reason about product decisions and generate PM-oriented outputs. The supplied code does not perform any product framing, prioritization, roadmap/spec drafting, metrics definition, or executive-summary generation. Instead, it is a repo maintenance/QA validation script for documentation integrity and release consistency. Its primary purpose, triggers, and behavior are materially different from the declared skill purpose, so this is a clear mismatch.
Content: No source excerpt is available for this finding.

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · docs/10-REAL-ENTRY-PROMPTS.md (reported line 51)May include surrounding context.
md
## 6. Need a roadmap story leadership can align on > Help me turn this quarter’s priorities into a roadmap leadership can align on. I need a single stage goal, a believable sequence, and a clear statement of what is intentionally not the focus this period. **Best fit:** `build-roadmap`

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · docs/SCENARIO-ROUTER.md (reported line 164)May include surrounding context.
md
## 6. Need a roadmap story leadership can align on > Help me turn this quarter’s priorities into a roadmap leadership can align on. I need a single stage goal, a believable sequence, and a clear statement of what is intentionally not the focus this period. **Best fit:** `build-roadmap`

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · benchmark/worked-example-clarify-request.md (reported line 103)May include surrounding context.
md
## Example rubric scoring | Criterion | General-purpose model | pm-workbench target | Why | | ---------------------------------- | --------------------: | ------------------: | --------------------------------------------------------------------------------------------- | | Upstream problem framing | 0 | 3 | One brainstorms features; the other reframes the ask into a problem the team can decide on | | Follow-up question quality | 0 | 3 | One asks none; the other asks only the two questions that matter most |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · benchmark/worked-example-exec-summary.md (reported line 105)May include surrounding context.
md
## Example rubric scoring | Criterion | Baseline answer | pm-workbench target | Why | | ---------------------------------- | --------------: | ------------------: | ---------------------------------------------------------------------------------- | | Upstream problem framing | 2 | 3 | Both understand the situation, but the target frames it as a scale-timing decision | | Follow-up question quality | 2 | 2 | Both may be acceptable without follow-ups in this scenario |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · benchmark/worked-example-product-leader.md (reported line 115)May include surrounding context.
md
## Example rubric scoring | Criterion | Baseline answer | pm-workbench target | Why | | ---------------------------------- | --------------: | ------------------: | ---------------------------------------------------------------------------------- | | Upstream problem framing | 2 | 3 | Both understand the situation, but the target frames it as a scale-timing decision | | Follow-up question quality | 2 | 2 | Both may be acceptable without follow-ups in this scenario |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · benchmark/worked-example-product-leader.md (reported line 111)May include surrounding context.
md
## Example rubric scoring | Criterion | Baseline answer | pm-workbench target | Why | | ---------------------------------- | --------------: | ------------------: | ----------------------------------------------------------------------------------------------------------------------------------- | | Upstream problem framing | 1 | 3 | One lists items; the other defines the portfolio objective first | | Follow-up question quality | 1 | 2 | Generic AI often asks little or asks generic questions; `pm-workbench` should ask only if objective or hard constraints are missing |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · benchmark/worked-example-product-leader.md (reported line 116)May include surrounding context.
md
| Upstream problem framing | 1 | 3 | One lists items; the other defines the portfolio objective first | | Follow-up question quality | 1 | 2 | Generic AI often asks little or asks generic questions; `pm-workbench` should ask only if objective or hard constraints are missing | | Recommendation quality | 1 | 3 | One hedges; the other makes a constrained top-3 call | | Trade-off and non-decision clarity | 1 | 3 | The target answer makes the below-the-line explicit | | Artifact reuse quality | 1 | 3 | The target answer reads like a real prioritization stack | | Product-leader relevance | 1 | 3 | The target answer is legible for leadership review | | Honesty about uncertainty | 2 | 2 | Both can label assumptions if needed |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · benchmark/worked-example-product-leader.md (reported line 118)May include surrounding context.
md
| Recommendation quality | 1 | 3 | One hedges; the other makes a constrained top-3 call | | Trade-off and non-decision clarity | 1 | 3 | The target answer makes the below-the-line explicit | | Artifact reuse quality | 1 | 3 | The target answer reads like a real prioritization stack | | Product-leader relevance | 1 | 3 | The target answer is legible for leadership review | | Honesty about uncertainty | 2 | 2 | Both can label assumptions if needed | | **Total** | **8** | **19** | Clear practical differentiation |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · benchmark/worked-example-product-leader.md (reported line 119)May include surrounding context.
md
| Trade-off and non-decision clarity | 1 | 3 | The target answer makes the below-the-line explicit | | Artifact reuse quality | 1 | 3 | The target answer reads like a real prioritization stack | | Product-leader relevance | 1 | 3 | The target answer is legible for leadership review | | Honesty about uncertainty | 2 | 2 | Both can label assumptions if needed | | **Total** | **8** | **19** | Clear practical differentiation | ---

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · benchmark/worked-example-product-leader.md (reported line 120)May include surrounding context.
md
| Artifact reuse quality | 1 | 3 | The target answer reads like a real prioritization stack | | Product-leader relevance | 1 | 3 | The target answer is legible for leadership review | | Honesty about uncertainty | 2 | 2 | Both can label assumptions if needed | | **Total** | **8** | **19** | Clear practical differentiation | ---

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The section labels the text as an 'Example command-style prompt' but does not specify whether the example is illustrative only or an actual invocation pattern. Without an explicit list of accepted trigger phrases, scope limits, or exclusion conditions, users and routing systems may treat broad natural-language requests as valid triggers.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file includes an example command-style prompt starting with 'First help me...', which is a very generic phrase common in ordinary conversation. Because the page presents these as command-style combinations without defining stricter activation boundaries or negative examples, the trigger wording is broad enough to risk unintended invocation overlap.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The phrase 'First help me clarify...' is generic conversational language rather than a narrowly scoped trigger. In a markdown command reference, this can blur the line between normal PM discussion and intentional command invocation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The example begins with 'Help me turn this overloaded quarter...' which reads like ordinary advisory language. Because the document does not define constrained trigger syntax, this broad wording could unintentionally overlap with non-command requests.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The example 'Draft the working PRD first...' is presented as a command-style prompt but remains broad enough to be interpreted as normal work guidance. The file does not establish clear trigger scope to separate explicit activation from everyday language.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The prompt 'Help me write the leadership call...' is common advisory language and not clearly distinguished from ordinary collaboration. Absent negative examples or non-activation conditions, the trigger scope is too open-ended for a command reference.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file is natural-language documentation, so language-policy checks apply. The content appears to force a single locale for users of this command reference without offering opt-in, alternatives, or justification that it is region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The entire skill example is written in Simplified Chinese and the file path examples.zh-CN/... indicates a locale-specific variant, but the content does not explicitly state that language choice is optional or that this is a region-specific example. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The example invocation is written as a direct instruction to produce a PRD in Chinese, and the file provides no indication that language choice is optional or user-selectable. This can violate language/locale policy when a skill implicitly constrains output language without explicit opt-in or justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example invocation begins with "Help me," which is a generic phrase commonly used in ordinary conversation. In a markdown skill description, such broad phrasing can make activation boundaries unclear and increase the risk of unintended invocation if this text is reused as a trigger pattern.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example prompt begins with "Help me turn this overloaded quarter into something leadership can approve," which uses a broad everyday-help formulation rather than a narrowly scoped activation phrase. The file does not provide explicit trigger constraints or negative examples, so this wording could cause unintended invocation in general planning conversations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The listed trigger phrases include common expressions such as "How should we plan the next quarter?" and "What should this stage focus on?" that could arise in ordinary discussion without clearly indicating this specific roadmap workflow. Although the file has routing rules, it does not provide negative examples or tighter constraints for distinguishing roadmap-building from adjacent planning tasks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger phrases are broad, natural-language examples such as vague requests for help unpacking or breaking something down, which can overlap with many ordinary conversations. In an agent-routing context, this can cause over-invocation of the workflow, leading the system to enter clarification mode when the user actually intended evaluation, drafting, or another task, reducing reliability and potentially steering outputs away from user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The listed trigger phrases include common expressions such as "Help me compare these two options," "Which solution should we choose?" and "Help me explain the trade-offs," which are broad enough to overlap with ordinary discussion rather than a narrowly scoped workflow invocation. Although the file has routing rules, these examples are still phrased generically and may invite ambiguous activation in contexts outside this specific decision workflow.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.