Product Review Panel

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:23 AM UTC
• Version: 1.0.1

Overview

This is a Markdown-only PRD review skill with disclosed persona routing and no evidence of code execution, persistence, data exfiltration, or destructive behavior.

Safe to install as a decision-support skill. Treat its GO / NO-GO verdicts as structured critique rather than binding business authority, and explicitly request a language or panel if you do not want the automatic conversation-language default.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

## What NOT to do during intake

- Do not summarize or restate the PRD back to the PM
- Do not lecture about why a field is important (the question itself is the lecture)
- Do not ask the same question twice if skipped
- Do not be sycophantic ("great question", "well-written PRD" without specifics)
- Do not lose the P9 character voice mid-conversation

• Confidence: 85% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The README advertises very broad trigger phrases like 'review my PRD' and 'panel review my proposal' and says the skill may be auto-routed, but it does not define clear eligibility boundaries at invocation time. In a skill ecosystem with automatic routing, this can cause unintended activation on adjacent requests, leading the agent to apply the wrong workflow, consume excessive context, or steer the conversation into a binding-style verdict the user did not explicitly request.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The skill automatically selects personas based on the user's conversation language without explicit consent or override. While not directly enabling code execution or data exfiltration, this is a policy/UX integrity issue because it can steer outputs using culturally specific framing the user did not request, which may be inappropriate or manipulative in sensitive decision-making contexts.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

- No profanity or aggressive insults
   - Critique the PRD, not the person — full list in each persona file

3. **Maximum 5 intake rounds.** If the PM is uncooperative, proceed with assumptions. Do NOT loop forever asking for info.

4. **No numeric scoring.** Tendency labels only. Numbers create false precision.

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file presents itself as a calibration reference for reviewing a realistic Chinese PRD and uses Chinese as the primary input/output language. There is no indication that the user can choose another language or that the Chinese-only framing is a justified region-specific constraint, which makes this a natural-language locale policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This markdown file states that a realistic English PRD should be used as the calibration reference for the international version. That creates a language policy concern because it privileges a specific language as the default standard without user opt-in or a documented regional/compliance justification.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file explicitly states that Chinese conversations trigger a Chinese expert panel, which overrides user choice of output language or persona set without an explicit opt-in. This is primarily a control/UX and policy-compliance issue rather than a direct security exploit, but it can cause unwanted language steering and reduce user agency.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The file states it is used when the user's conversation is in English or other non-Chinese languages, creating a language-based routing rule without indicating user choice or consent. This is a natural-language locale policy constraint, and the file does not offer an opt-in or alternative language selection mechanism.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The title and opening instructions define the dialogue format specifically in Chinese and English, including required utterances for each. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation, and this file does not state that the user may choose their preferred language or that the skill is limited to a bilingual context.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file explicitly defines the primary complete output skeleton as Chinese, which imposes a specific language/locale on generated output. Although an English variant is mentioned later, the template presents Chinese as the default full structure without stating that language should be chosen based on user preference or opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The file defines separate 'Chinese panel' and 'International panel' configurations, but does not state how the user chooses between them or provide an explicit opt-in. This creates a locale/language policy concern because the skill appears to force a panel framing tied to language or region without documented user choice or justification.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The validity checklist hard-codes the closing word as either Chinese ("完。") or English ("Done."), and elsewhere the file includes required fallback/output phrases in Chinese such as "无显著反对意见." This imposes a language choice in output instructions without stating that the user can choose their preferred language or locale.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The skill states that the panel automatically switches based on the user's conversation language, without indicating an explicit opt-in or override at selection time. While not directly a code-execution issue, this can produce unexpected behavior, incorrect expert framing, or unwanted personalization/locale assumptions, especially in multilingual conversations or when the user wants a specific panel regardless of language.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: Line L05 instructs the skill to 'Pick the version matching the user's conversation language,' which imposes a language-selection policy automatically. Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy concern unless the user is explicitly offered a choice or the constraint is justified.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: This markdown file includes separate Chinese and English templates, but the surrounding instructions do not state that language selection should follow user preference or explicit opt-in. Under the policy rule, language or locale constraints should either offer a choice or clearly document the justification for using a specific language.

Static analysis

No suspicious patterns detected.