MVP 产品可行性验证

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:25 AM UTC
• Version: 0.1.0

Overview

This skill is a straightforward MVP validation assistant with some usability and disclosure cautions, but no evidence of malicious behavior.

Before installing, be aware that the skill may create a saved Markdown report containing your product idea and may include fixed attribution text. Review the generated report before sharing it, and ask the agent to keep results inline or choose a specific filename if you do not want persistent files created.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:181

Finding

Mandatory Branded Attribution in Generated Reports

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 181
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Complete Code Snippet:

markdown

> 本报告由 OPC-AI Skill（mvp-validator）生成，基于《AI超级个体》书稿框架。

English translation:

text

This report was generated by the OPC-AI Skill (mvp-validator), based on the framework from the “AI Super Individual” manuscript.

Technical Analysis

The skill's prescribed report template requires the agent to append a fixed attribution promoting “OPC-AI Skill” and a referenced publication. This content is not necessary to perform the requested MVP validation and is inserted into ordinary user deliverables whenever the template is followed.

Because the instruction changes the content of the agent's final output for branding purposes, it constitutes skill-level output manipulation under T01: Skill Instruction Hijacking. The behavior does not override safety controls or execute code, but it compromises output integrity by embedding unsolicited attribution into documents that users may treat as their own reports.

Attack Path

1. A user invokes the skill with an MVP-validation request.
2. The agent loads and follows the instructions in SKILL.md.
3. The agent uses the mandatory report template.
4. The fixed branded attribution at line 181 is appended to the generated report.
5. The user may save or distribute the report with the injected promotional content still present.

Impact Assessment

The issue affects generated-report content and document integrity. An attacker does not gain operating-system privileges, code-execution capabilities, credentials, persistent access, or access to unrelated user data.

The scope is limited to reports generated from the affected template. The principal impact is that users may unknowingly distribute documents containing third-party branding or attribution that they did not explicitly request. ...[truncated 108 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the fixed attribution from the default report template.
2. Restrict the template to content directly required for MVP validation.
3. If attribution is desired, make it explicitly optional and obtain user consent before adding it.
4. Clearly preview any attribution before generating or saving the report.
5. Add a template-review requirement prohibiting unsolicited branding, promotional language, links, or third-party endorsements in user deliverables.
6. Test the revised skill with representative requests and confirm that generated reports contain no branding unless the user explicitly opts in.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad, generic conversational expressions such as '值得做吗' and '帮我验证', which can cause the skill to activate during ordinary discussion rather than through deliberate invocation. In an agent environment, unintended activation can redirect the assistant into collecting business-planning data or taking follow-on actions out of context, creating prompt-routing and least-surprise issues even if the skill is not overtly malicious.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to write a Markdown report to a default filename without first notifying the user or obtaining consent. In systems with filesystem or workspace write access, this can create unexpected side effects, overwrite existing files with similar names, or leak sensitive business information into persistent storage the user did not intend to create.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest contains a default prompt in English even though the surrounding skill metadata is in Chinese, which imposes a specific language choice without indicating user preference or offering alternatives. This is a natural-language policy concern because the skill appears to assume English interaction by default rather than allowing locale selection.

Content

No source excerpt is available for this finding.