Security audit

Entrepreneur PM Framework

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed AI-team management playbook, but it exposes sensitive Shopify admin access patterns and normalizes persistent agent/skill changes without enough user control.

Install only if you are comfortable with a management skill that steers agent routing and task templates. Before use, remove or restrict the Shopify token path, require explicit approval for any production store mutation, limit subagent secret/tool access by role, and require review before writing persistent lessons or modifying any Skill files.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:130
Finding: Unvalidated Agent Output Can Be Written to Persistent Memory and Skill Files
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/agent-capabilities.md:45
Finding: Administrative Credential Path Is Exposed to Broadly Privileged Delegated Agents
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The listed trigger phrases are common operational terms rather than distinctive invocation tokens, so they are likely to collide with everyday management or planning dialogue. This increases the chance that the skill activates spuriously and influences agent behavior, including forced routing and mandatory skill usage, outside its intended context.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The listed trigger phrases are common operational terms rather than distinctive invocation tokens, so they are likely to collide with everyday management or planning dialogue. This increases the chance that the skill activates spuriously and influences agent behavior, including forced routing and mandatory skill usage, outside its intended context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill metadata and body are written to operate in Chinese and present the framework as mandatory, without indicating user language preference handling or opt-in. This can cause misunderstanding, inaccessible outputs, or unintended constraint of downstream agents in multilingual settings, especially when the skill may already activate too broadly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Line L97 states '中文说明 + 英文可直接使用的文案', which prescribes a fixed language/locale behavior. Under the policy, forcing a specific language without offering user choice or opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The example task package explicitly instructs an agent to perform live Shopify REST API updates directly in production and only verify by reading the modified field afterward. In an agent-skill context focused on task delegation and execution quality, this can normalize unsafe autonomous writes to live business systems without requiring confirmation, staging, rollback planning, or change-approval safeguards, increasing the chance of accidental destructive changes.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.