PM Interview Grill

• Outcome: Review
• Latest audit: Aug 8, 2026 · 9:57 AM UTC
• Version: 1.0.0

Overview

This is a PM interview coaching skill made of documentation and prompt guidance, with no executable code or hidden data access.

Install this only if you want a Chinese-first, high-pressure PM mock interview coach. The publisher should change the absolute file:// reference links to relative paths, but the reviewed artifact does not show hidden execution, data exfiltration, credential access, or destructive behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger examples include very common natural-language phrases such as '帮我准备产品经理面试' and related PM interview requests, which can cause the skill to activate in situations where the user did not explicitly intend to invoke this specific behavior. In an agent environment, overly broad activation increases the chance of prompt/behavior hijacking of ordinary conversations and can override user expectations with a rigid interview persona.

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: The README presents the skill almost entirely in Chinese and all listed trigger phrases are Chinese or skill-name specific, which strongly biases interaction toward Chinese without clearly indicating language negotiation or user-choice behavior. This is not a direct security flaw, but it can cause unintended mode/language switching, reduce transparency, and make agent behavior less predictable for users operating in other languages.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill hard-codes a Chinese welcome message and directs the interaction flow in Chinese without checking the user's language preference. This can override user intent, degrade accessibility, and create prompt-level behavior that is misaligned with the user's requested language or enterprise policy requirements.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

## 📚 参考资料库

本 Skill 包含以下详细参考指南，位于 `references/` 目录中：
- [PM 核心思维框架库](file:///Users/suxiaohan/.gemini/config/skills/pm-interview-grill/references/pm_frameworks.md)：包含 CIRCLES, STAR, AARM, BUS, DIGS 等面试金牌框架。
- [大厂 PM 高频真题库](file:///Users/suxiaohan/.gemini/config/skills/pm-interview-grill/references/pm_question_bank.md)：涵盖 Product Design, Metrics, Strategy, Behavioral 四大板块题目。
- [评估 Rubric 指南](file:///Users/suxiaohan/.gemini/config/skills/pm-interview-grill/references/coaching_rubric.md)：多维度评分标准与追问策略指南。

• Confidence: 97% confidence
• Finding: /.gemini/config

Agent Config Directory Access

High

• Category: Agent Snooping

Content

本 Skill 包含以下详细参考指南，位于 `references/` 目录中：
- [PM 核心思维框架库](file:///Users/suxiaohan/.gemini/config/skills/pm-interview-grill/references/pm_frameworks.md)：包含 CIRCLES, STAR, AARM, BUS, DIGS 等面试金牌框架。
- [大厂 PM 高频真题库](file:///Users/suxiaohan/.gemini/config/skills/pm-interview-grill/references/pm_question_bank.md)：涵盖 Product Design, Metrics, Strategy, Behavioral 四大板块题目。
- [评估 Rubric 指南](file:///Users/suxiaohan/.gemini/config/skills/pm-interview-grill/references/coaching_rubric.md)：多维度评分标准与追问策略指南。

---

• Confidence: 97% confidence
• Finding: /.gemini/config

Agent Config Directory Access

High

• Category: Agent Snooping

Content

本 Skill 包含以下详细参考指南，位于 `references/` 目录中：
- [PM 核心思维框架库](file:///Users/suxiaohan/.gemini/config/skills/pm-interview-grill/references/pm_frameworks.md)：包含 CIRCLES, STAR, AARM, BUS, DIGS 等面试金牌框架。
- [大厂 PM 高频真题库](file:///Users/suxiaohan/.gemini/config/skills/pm-interview-grill/references/pm_question_bank.md)：涵盖 Product Design, Metrics, Strategy, Behavioral 四大板块题目。
- [评估 Rubric 指南](file:///Users/suxiaohan/.gemini/config/skills/pm-interview-grill/references/coaching_rubric.md)：多维度评分标准与追问策略指南。

---

• Confidence: 97% confidence
• Finding: /.gemini/config

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SYSTEM_PROMPT.md:1