Security audit

MVP 产品可行性验证

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent MVP validation assistant, with only minor disclosure and routing concerns around broad triggers and default report-file creation.

Before installing, expect this skill to guide MVP/customer-demand validation, optionally use research tools, and save a Markdown report by default. Review generated reports for the fixed OPC-AI attribution footer and ask the agent to provide inline output or a neutral report if you do not want a saved or branded file.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

Location: SKILL.md:181
Finding: Mandatory Branded Attribution in User-Facing Reports## Vulnerability Details **File Location**: `SKILL.md`, line 181 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Low **Code Snippet**: ```markdown > This report was generated by OPC-AI Skill (mvp-validator), based on the AI Super Individual manuscript framework. ``` The snippet above is an English translation of the fixed footer in the source file. ### Technical Analysis The mandatory report template instructs the agent to append fixed OPC-AI branding and manuscript attribution to generated reports. This content is not necessary to perform MVP feasibility validation and modifies the agent's user-facing output for promotional or attribution purposes. Because the footer is embedded in the prescribed output template, an agent following the Skill may reproduce it automatically without asking whether the user wants third-party branding. This constitutes limited output manipulation rather than code execution, privilege escalation, or compromise of the agent's safety controls. ### Attack Path 1. A user invokes the `mvp-validator` Skill. 2. The agent follows the report workflow and mandatory Markdown template in `SKILL.md`. 3. The agent generates or saves an MVP feasibility report. 4. The fixed branded footer is inserted into the report. 5. The user may distribute the report without realizing that it contains third-party attribution, potentially creating an unintended appearance of affiliation or endorsement. ### Impact Assessment The issue affects the integrity and neutrality of generated documents. It may cause unsolicited branding to appear in reports and may imply an affiliation with OPC-AI or the referenced manuscript. No system privileges, credentials, local execution capabilities, persistent access, or access to additional data can be obtained through this behavior. The scope is limited to user-facing report content.
Remediation: ## Remediation Suggestions 1. Remove the fixed branded footer from the mandatory output template. 2. If attribution is operationally necessary, make it optional and request explicit user consent before including it. 3. Clearly distinguish factual methodology citations from promotional branding. 4. Permit users to generate neutral, unbranded reports by default. 5. Review the remainder of the output template for other fixed content that is unrelated to the user's requested analysis.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrases are broad, natural-language expressions such as '值得做吗' and '帮我验证', which can appear in ordinary conversation unrelated to this specific skill. This can cause unintended activation, leading the agent to follow the skill’s workflow unexpectedly, potentially overriding user intent, consuming tools, or creating artifacts such as reports without the user clearly requesting the skill.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill defaults to creating a Markdown file but does not clearly notify the user or request consent before doing so. Unannounced file creation is dangerous because it can surprise users, create unwanted artifacts, overwrite expected outputs, or be combined with ambiguous product names to generate problematic filenames, especially in agent environments with filesystem access.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The default invocation prompt is very generic and can trigger this skill in a wide range of user requests without clearly constraining when it should be used. In a routing or tool-selection system, overly broad prompts can cause inappropriate activation, leading the agent to steer users into paid-validation workflows even when the request is unrelated or better handled by another skill.

Description-Behavior Mismatch

Low

Confidence: 84% confidence
Finding: The manifest describes the skill as helping validate ideas, assess MVPs, and test demand/pricing, which primarily suggests advisory analysis. Line L066 directs the assistant to write the full analysis to a Markdown file by default, adding a file-creation behavior not stated in the manifest description.

Static analysis

No suspicious patterns detected.