Security audit

roadmap-producto-f100k

Security checks for vulnerabilities and agentic risk

Overview

This is not malware, but it needs review because a roadmap skill also mandates sales-offer, financial-projection, public-posting, and persistent file outputs beyond its stated boundary.

Install only if you want a roadmap workflow that also produces sales-offer strategy, pricing, projections, pitch materials, and persistent copies in the second-brain folder. Review generated files before sharing by Telegram or posting in a community, and redact client names, metrics, revenue figures, and private business plans.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

High

Confidence: 97% confidence
Finding: The activation trigger includes an extremely broad catch-all phrase covering nearly any request about structuring product journey or content. Overbroad routing criteria can cause the skill to hijack unrelated user requests, leading to unintended file generation, workflow execution, or scope creep in multi-skill environments.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The manifest frames the skill as a roadmap-construction tool, but the body expands it into offer design, financial projections, risk mapping, and pitch presentation generation. This hidden scope expansion can cause the agent to invoke the skill in contexts the user did not intend, increasing the chance of unauthorized persuasive, commercial, or operational output beyond the declared purpose.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The documentation explicitly says not to use this skill for sales offers, then later instructs the agent to build the offer stack directly inside the same skill. This contradiction undermines routing controls and can bypass intended separation-of-duties between roadmap design and sales-copy/offer construction, causing the wrong capability to activate and produce higher-risk commercial content.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The skill says it is the step before the offer-construction skill, but later includes instructions to generate the offer itself. This creates ambiguous orchestration logic that can make agents skip the intended workflow and overproduce content the user may not have requested.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: La instrucción fuerza una variante lingüística concreta como política general de salida, en lugar de adaptarse a la preferencia del usuario o solicitarla. Esto encaja con una violación de política de idioma/locale porque no hay mecanismo de elección ni justificación regional claramente delimitada.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: Además de la mención anterior, aquí la skill reafirma como regla absoluta una variante de idioma obligatoria sin opción del usuario. La repetición refuerza una restricción de locale no opt-in aplicable a todos los usos de la skill.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The community template instructs users to publish deliverables publicly in the forum to build social proof, but it does not require consent, privacy controls, or guidance on avoiding sensitive personal, business, or client data. In a community/Skool context, this can lead to oversharing, accidental disclosure of confidential information, and reputational or compliance issues, especially when deliverables may include business plans, metrics, or personal progress details.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: La línea L287 establece 'Español neutro' como requisito general en el checklist final. Esto fuerza una preferencia de idioma/variante lingüística sin ofrecer elección del usuario ni justificar una restricción regional o de cumplimiento.

Static analysis

No suspicious patterns detected.