AI Delivery Spec｜需求管理内核

• Outcome: Pass
• Latest audit: Sep 2, 2026 · 12:39 PM UTC
• Version: 5.4.9

Overview

This is a broad requirements and PRD workflow skill with local validation tools, and its sensitive behaviors are mostly disclosed and aligned with that purpose.

Install only if you want a broad requirements-management assistant. Invoke it explicitly for sensitive projects, pass only the files needed for the current stage, do not provide raw secrets, and treat legal/domain packs as references that require jurisdiction and stakeholder confirmation before becoming requirements.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_script(script: str, values: list[str]) -> int:
    # Resolve project-facing arguments from the caller's workspace, not from
    # the installed Skill directory. Bundled resources are located via __file__.
    return subprocess.run(
        [sys.executable, str(ROOT / "scripts" / script), *values],
        cwd=Path.cwd(), text=True,
    ).returncode

• Confidence: 82% confidence
• Finding: The helper dispatches to other Python scripts and forwards caller-controlled values into those scripts while setting cwd to the caller's current workspace. While shell injection is avoided, this pattern expands the attack surface because downstream scripts may interpret attacker-supplied paths or content unsafely, and execution occurs in an untrusted project directory where local files influence behavior. In a skill that explicitly operates on arbitrary requirement and project artifacts, this makes the subprocess bridge more security-relevant than a purely internal tool.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill advertises substantial capabilities such as environment access, file read/write, shell, and network use without any declared permission boundary or user-facing constraint. In an agent ecosystem, undeclared powerful capabilities reduce transparency and can enable unexpected data access, command execution, or exfiltration if the skill is invoked broadly or chained with other tasks.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The documented purpose is requirements/specification management, but the behavior described extends into repository integrity checks, secret scanning, manifest auditing, prototype code inspection, and domain catalog querying. This mismatch is dangerous because users and orchestrators may route sensitive contexts into the skill expecting documentation help, while the skill can inspect broader assets and metadata than its stated role implies.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: This script performs repository attestation, lifecycle gating, snapshotting, and validator execution that materially exceed the declared skill purpose of producing delivery artifacts. In an agent setting, undeclared capabilities increase the attack surface and can lead operators to grant broader filesystem and execution trust than the manifest justifies, making misuse or unintended data exposure more likely.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The instruction to 'always invoke regardless of size or clarity' creates an overbroad trigger surface that can cause the skill to run in many contexts where it is unnecessary or unsafe. Because the skill appears to have access to powerful capabilities and broad document-processing behavior, forced invocation increases the chance of unintended file access, over-collection of context, and sensitive data exposure.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The natural-language trigger examples are broad phrases like helping dig into requirements or write a PRD, without strong boundaries on what inputs may be loaded or when the skill should not activate. Generic triggers increase accidental activation and can pull the skill into conversations containing sensitive business, prototype, or system information that it does not need to access.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill allows implicit invocation (`allow_implicit_invocation: true`) while its description says it should be invoked for extremely broad situations ('always invoke regardless of size or clarity'). This creates an overbroad trigger surface where the skill may activate without clear user intent, causing prompt routing mistakes, unintended data exposure to the skill context, or unauthorized requirement-generation actions in sensitive workflows.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The OA domain applies_when list includes very generic terms like 'approval', 'meeting', and 'office knowledge', which can match many ordinary business conversations unrelated to a true OA workflow. In this skill, broad activation is more dangerous because the metadata says to 'always invoke regardless of size or clarity', increasing the chance of inappropriate routing, over-collection of context, or generation of domain-specific requirements in the wrong setting.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The Education IT applicability terms include broad words such as 'course', 'training', 'learning', and 'assessment', which commonly appear in general product, HR, or content contexts. Because this skill is designed for requirement generation and broad invocation, ambiguous routing can cause the system to assume education-specific workflows, compliance constraints, or data models where they do not belong.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The AI Native domain uses highly generic triggers like 'agent', 'tool calling', 'memory', and 'evaluation', which are common across ordinary technical discussions and many unrelated software tasks. In this skill context, that is especially risky because broad auto-invocation can steer benign requests into agentic-system assumptions, potentially introducing unnecessary autonomy, writeback patterns, or security-sensitive design elements into resulting specifications.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The file hard-codes a large catalog of China-specific laws, regulations, and policy sources across multiple domains, but the skill metadata says it should be invoked for virtually any requirements or product work regardless of size or clarity. That creates a real risk that the agent will anchor requirements, compliance claims, or design constraints to a China-only legal/regulatory baseline even when the user's jurisdiction, product scope, or locale was never established. The policy text includes some cautionary claim-limit language, which reduces severity, but it does not prevent unsafe default sourcing if the surrounding system consumes this catalog automatically.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The template hard-codes `document_language: zh-CN`, which can force downstream artifacts into Chinese regardless of the user's language, project context, or compliance needs. In an always-invoke requirements/spec skill, this can systematically bias outputs, reduce reviewability for non-Chinese-speaking stakeholders, and cause process or documentation mismatches across teams.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This template appears to enforce a Chinese locale without opt-in or justification, which can override user expectations and create silent specification drift in generated artifacts. Because this skill is designed to be invoked for nearly any requirements or PRD task, the locale forcing becomes more dangerous through scale: many documents may be produced in an unintended language before anyone notices.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The frontmatter sets `document_language: zh-CN` while also claiming `language_source: user_request`, creating a mismatch between stated behavior and actual default behavior. In a requirement/PRD generation skill that is always invoked, this can silently override user language preference, cause incorrect artifacts, and introduce review or implementation errors when downstream agents assume the generated language matches user intent.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The workflow `trigger` field is an unconstrained free-form string, so downstream agents or automation may interpret vague natural-language phrases inconsistently or too broadly. In this skill context, workflows drive requirements/spec behavior, so ambiguous activation text can cause unintended execution paths, misrouting, or policy bypass if other components rely on textual matching rather than explicit identifiers.

Unvalidated Output Injection

High

• Category: Output Handling

Content

add("product_truth", False, "specify and later stages require an anchored Product Truth checkpoint")
        else:
            command = [sys.executable, str(ROOT / "scripts" / "validators" / "validate_product_truth.py"), truth_anchor["path"]]
            result = subprocess.run(command, cwd=ROOT, text=True, encoding="utf-8", capture_output=True, check=False)
            add("product_truth", result.returncode == 0, (result.stdout + result.stderr).strip())
            truth = load(Path(truth_anchor["path"]))
            requirements = truth.get("requirements", [])

• Confidence: 74% confidence
• Finding: The validator's combined stdout/stderr is inserted directly into gate messages and then serialized to output files and console logs without sanitization. If a crafted validator input causes terminal control sequences, misleading multiline content, or hostile structured text to be emitted, this can corrupt logs, spoof results, or mislead reviewers in a security-sensitive gating workflow.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.