Security audit

需求迭代工作流

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only development workflow skill whose repository writes and commits are disclosed and aligned with its purpose.

Install this only if you want an agent to manage a requirements-to-implementation loop in a repository. Use a clean branch, review generated specs and IMPLEMENTATION_PLAN.md before execution, and inspect diffs before allowing commits, especially because the template stages all changes with 'git add .'.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: Phase 1 can be triggered by broad natural-language phrases such as discussing or clarifying requirements, which may overlap with ordinary conversation. That can cause the agent to enter a workflow mode and start structured questioning or file-writing behavior without sufficiently explicit user intent, increasing the chance of unintended actions in the workspace.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The workflow instructs the agent to write discussion results into specs/topic-xxx.md, but it does not require a user-facing warning or confirmation before modifying the workspace. This can lead to unintended file creation or overwriting when a user believes they are only having a conversation, especially because the phase is triggered by broad requirement-discussion language.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Creating IMPLEMENTATION_PLAN.md is a direct workspace modification, yet the instructions do not require informing the user or obtaining consent before the file is generated. In practice, this can surprise users, overwrite existing planning documents, or introduce persistent artifacts into repositories during what may have been intended as advisory-only planning.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The iteration phase instructs the agent to validate, commit, and update the plan, but it does not require an explicit warning that code, files, and git history will be changed. Automatic commits are more dangerous than ordinary file writes because they create durable repository history, may include unintended changes, and can complicate rollback or audit if triggered without clear consent.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger phrase "迭代" is extremely broad in the context of a planning/workflow skill and is likely to appear in normal user conversation about software development, requirements, or process. This can cause unintended activation of the skill, leading the agent to switch workflows, consume context, or take planning-oriented actions the user did not explicitly request.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The prompt explicitly directs the agent to run `git add .` and create a commit automatically, with no requirement for user approval, review of staged files, or limitation to task-relevant changes. In an agentic workflow, this can persist unintended, sensitive, or malicious modifications into version control, making harmful changes harder to notice and easier to propagate.

Static analysis

No suspicious patterns detected.