Review Business Requirement Document Skill

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:01 AM UTC
• Version: 1.0.0

Overview

This skill reads a user-selected BRD Word document and creates review JSON plus a separate reviewed Word document, with no evidence of hidden persistence, exfiltration, or unrelated behavior.

Before installing, use an isolated virtual environment and consider pinning dependency versions. Run the skill only on BRDs you intend to have processed locally, and review the generated .review.json and .reviewed.docx before sharing them because they contain extracted document text, comments, and proposed edits.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:62

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:62-66
Vulnerability Type: Unpinned dependencies and non-reproducible package installation
Risk Level: Medium

markdown

## Dependencies
Install once if missing:
```bash
python -m pip install python-docx lxml

text

### Technical Analysis

The Skill instructs users to install `python-docx` and `lxml` from the package index without version constraints, cryptographic hashes, or a committed lock file. Consequently, the packages and their transitive dependencies are resolved to mutable releases at installation time.

This does not demonstrate that either named package is currently malicious. However, the installation process creates a supply-chain exposure because the code installed and executed by users can differ from the code considered during this audit. If an upstream project, maintainer account, release artifact, or transitive dependency is compromised, a subsequent installation could introduce attacker-controlled code.

### Attack Path

1. An attacker compromises one of the named packages, its release process, or a transitive dependency.
2. The attacker publishes a malicious release that remains compatible with the unconstrained package names.
3. A user follows the documented `pip install` command.
4. Pip selects and downloads the malicious or compromised release from the configured package index.
5. Attacker-controlled code executes during installation or when the dependency is imported by the BRD pipeline.

### Impact Assessment

Malicious dependency code would execute with the privileges of the user running pip or invoking the Skill. Depending on those privileges, it could access user-readable files, modify files writable by that user, inspect BRD contents processed by the pipeline, steal accessible credentials, or establish additional malicious behavior.

The scope is normally limited to the invoking user's permissions. If installation or execution is performed from a privileged account or
...[truncated 99 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin all direct dependencies to versions that have been reviewed and tested, for example through a committed requirements file.
2. Pin transitive dependencies by generating a fully resolved lock file with a trusted dependency-management tool.
3. Record cryptographic hashes for every accepted distribution and install with pip --require-hashes.
4. Install exclusively from an explicitly configured trusted package index.
5. Prefer isolated virtual environments rather than user-wide or system-wide installation.
6. Add automated dependency vulnerability and integrity scanning to the release process.
7. Review and update pinned versions through a controlled process rather than resolving the newest available releases at runtime.

A hardened installation pattern would be:

bash

python -m pip install --require-hashes -r requirements.lock

SkillSpector

Vulnerability Patterns

• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: brd-reviewer
description: Review Business Requirements Documents in `.docx` format by reading the existing BRD, extracting paragraph-level context, drafting clarification questions for unclear statements, and producing a final Word document that combines comments and tracked changes. Use when the user wants a BRD reviewed, challenged for ambiguity, or redlined with proposed wording improvements while preserving Word-native review features.
---

# BRD Reviewer

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill instructs the agent to read and write local files and invoke Python scripts, but it does not declare any explicit tool scope such as allowed tools or permissions. That omission weakens least-privilege controls and makes it easier for an agent runtime to grant broader file access than is actually required, especially because the workflow processes user-supplied paths and creates output files beside the source document.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The markdown states that the skill extracts from an existing BRD and produces a final .docx with comments and tracked changes, but it does not explicitly warn users that the workflow writes a new review artifact derived from their document content. Because this behavior affects user files and document contents, a brief user-facing warning in the README would improve safety transparency.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.