T08 · Insecure Dependencies
Warning
- Location
SKILL.md:14- Finding
Unpinned npm Dependency Creates a Mutable Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
PRD Creator
Security checks for vulnerabilities and agentic risk
Overview
This PRD-writing skill is coherent and locally scoped, with the main caution being an unpinned/global npm dependency for optional Word export.
Installers should know this is primarily a Chinese-language PRD template/generator. Use the Word export only with Markdown files you intend to convert, and prefer a local, pinned docx dependency instead of following the global npm install recommendation.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents the skill primarily as a PRD generator in Markdown, with Word export as an optional secondary feature. The actual code chunk only implements the export/conversion portion: it accepts an input .md file path, parses Markdown elements (headings, tables, code blocks, lists, blockquotes, etc.), and writes a styled .docx file. There is no logic for drafting, structuring, or generating PRD content from a user request, nor any trigger-handling behavior matching phrases like “写PRD” or “产品需求文档.” While the optional .docx export aligns with part of the description, the primary declared purpose is materially broader and different from the actual behavior shown. Therefore this is a mismatch.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest says to activate when the user 'wants to design/document a software feature/module/product,' which is much broader than explicit PRD-writing requests and overlaps with ordinary conversation about product ideas. It does not clearly distinguish when general design discussion should invoke the skill versus when it should not.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The listed triggers include '用户描述一个功能/模块/产品，需要结构化文档输出,' which is subjective and could match many normal requests for analysis or planning. The file does not provide negative examples or constraints clarifying when this should not activate.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The entire PRD template, including headings, status values, instructions, and checklist items, is written in Chinese and implicitly requires PRDs to be authored in that language. Under the policy, forcing a specific language without user opt-in or a documented regional/business justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document explicitly requires '全文使用简体中文', which is a natural-language locale constraint. Under the policy, forcing a specific language without user opt-in or a clearly justified region-specific need is a violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The entire skill document is written in Chinese and does not indicate that users may choose another language or that the locale restriction is intentional and justified. Under SQP-3, natural-language policy violations include forcing a specific language without user opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This markdown file describes users entering custom questions into a Demo conversation and later defines analytics events tracking that interaction, but it does not warn that user inputs may be processed or logged. For markdown files, SQP-2 applies when behaviour affecting user data or privacy is described without a warning.
- Content
Static analysis
No suspicious patterns detected.