Propaymun Information Architecture

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:25 AM UTC
• Version: 1.0.4

Overview

This skill is a disclosed information-architecture helper with optional local validation/export scripts and no evidence of hidden network, credential, persistence, or destructive behavior.

Installers should understand that this skill can guide IA decisions and, when asked, create local files through optional helper scripts. Review generated handoffs before using them in a builder, and provide explicit paths only when you want files created.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (21)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: propaymun-information-architecture
description: Shape, review, and validate end-to-end product information architecture, product/UX sitemaps, and stateful user flows when users need clearer structure, labels, relationships, access, findability, destinations, or task paths. Keep one evidence-aware semantic foundation and turn it into the requested human, visual, or technical handoff without forcing a full IA process when a focused companion artifact is enough.
metadata:
  version: "1.0.4"
  author: "ProPaymun"
  license: "MIT-0"
---

# ProPaymun Information Architecture

Act as a product and IA decision partner. Help people desc

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

- Do not claim that `SKILL.md`, a local path, or another resource is missing or unreadable unless the user requested diagnostics and the current host supplied d

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

Prefer direct product evidence and representative user evidence over generic best practices. Treat analytics as behavioral evidence, not intent; interviews as reported experience, not frequency; card sorting as grouping evidence, not final IA; and AI output as a hypothesis.

Evidence-status terms belong in internal state and reusable team or machine artifacts. In ordinary conversation, translate them into natural phrases such as “طبق توضیح شما”، “از شواهد فعلی چنین برمی‌آید”، or “فعلاً این فرض قابل تغییر را در نظر می‌گیرم.” Do not make a novice decode `Proposed`, `Provisional`, or similar control labels.

## Capability-aware research

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/evidence.md (reported line 23)May include surrounding context.

md

Prefer direct product evidence and representative user evidence over generic best practices. Treat analytics as behavioral evidence, not intent; interviews as reported experience, not frequency; card sorting as grouping evidence, not final IA; and AI output as a hypothesis.

Evidence-status terms belong in internal state and reusable team or machine artifacts. In ordinary conversation, translate them into natural phrases such as “طبق توضیح شما”، “از شواهد فعلی چنین برمی‌آید”، or “فعلاً این فرض قابل تغییر را در نظر می‌گیرم.” Do not make a novice decode `Proposed`, `Provisional`, or similar control labels.

## Capability-aware research

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/visual-builder-handoff.md (reported line 43)May include surrounding context.

md

Prefer direct product evidence and representative user evidence over generic best practices. Treat analytics as behavioral evidence, not intent; interviews as reported experience, not frequency; card sorting as grouping evidence, not final IA; and AI output as a hypothesis.

Evidence-status terms belong in internal state and reusable team or machine artifacts. In ordinary conversation, translate them into natural phrases such as “طبق توضیح شما”، “از شواهد فعلی چنین برمی‌آید”، or “فعلاً این فرض قابل تغییر را در نظر می‌گیرم.” Do not make a novice decode `Proposed`, `Provisional`, or similar control labels.

## Capability-aware research

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/export_builder_handoff.py (reported line 67)May include surrounding context.

python

, depth + 1) for part in value)
    if len(json.dumps(model, ensure_ascii=False).encode("utf-8")) > 1000000:
        raise ValueError("Model exceeds export limit (1 MB); export a focused IA view")


def launch_text(language: str, intent: str = "ia-blueprint") -> str:
    if intent == "product-prototype":
        if language.lower().startswith("fa"):
            return "فایل Markdown پیوست‌شده را به‌عنوان قیود معماری اطلاعات محصول بخوان و نمونهٔ اولیه را بر همان اساس بساز؛ ساختار و قواعد تأییدشده را تغییر نده و اطلاعات جدید اختراع نکن."
        return "Read the attached Markdown file as the product's information-architecture constraints. Build the prototype from them without changing approved structure or inventing information."
    if language.lower().startswith("fa"):
        return "فایل Markdown پیوست‌شده را به‌عنوان مشخصا�

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/render_ia_html.py (reported line 26)May include surrounding context.

python

mation domains", "structure": "Information structure", "connections": "Key connections",
        "needs": "Priority information needs", "roles": "Roles and access", "lifecycles": "Lifecycles", "navigation": "Navigation and findability",
        "assumptions": "Assumptions", "unknowns": "Unknowns", "decisions": "Decisions", "validation": "Validation",
    },
    "fa": {
        "domains": "حوزه‌های اطلاعاتی", "structure": "ساختار اطلاعات", "connections": "ارتباط‌های کلیدی",
        "needs": "نیازهای اطلاعاتی اولویت‌دار", "roles": "نقش‌ها و دسترسی", "lifecycles": "چرخه‌های عمر", "navigation": "ناوبری و یافتن اطلاعات",
        "assumptions": "فرضیات", "unknowns": "موارد نامشخص", "decisions": "تصمیم‌ها", "validation": "اعتبارسنجی",
    },
}


def human_value(value: Any) -> str:
    if isinstance(value, bool):
        return "Yes" if value

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill text explicitly references local helper scripts and discusses file creation/export behavior, but the manifest declares no explicit tool scope or permissions boundary. In an agent environment, this creates ambiguity about whether file, network, or other capabilities may be invoked implicitly, which can lead to over-privileged execution or unsafe assumptions by the host/runtime.

Content

No source excerpt is available for this finding.

Persistent Context Injection

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.

Content

Scanner excerpt · references/capability-routing.md (reported line 110)May include surrounding context.

md

## Installation and configuration are different

- A native Skill runtime discovers `SKILL.md` and its resources.
- A web Project, Gem, or custom Agent usually needs a persistent instruction plus an uploaded knowledge file.
- A one-off chat can use the Workspace Kit knowledge file as an attachment plus the short workspace instruction.

Do not call file upload or prompt pasting a native Skill installation. The behavior contract stays the same, but persistence, automatic triggering, tools, and context limits may differ by surface.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The sample Semantic IA JSON sets "language": "en", which can be interpreted as a default requirement to produce artifacts in English. The policy allows locale/language constraints only when users are given a choice or when the constraint is clearly justified, neither of which is stated here.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

The agent carries the IA method. The user supplies product knowledge in ordinary language. Never transfer professional quality-control work to a user who may not know IA.

Do not ask the user to choose Guided/Quick modes, approve jargon-heavy models, select a checkpoint, or restate “stop and wait.”

## Adaptive sufficiency loop

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/discovery.md (reported line 9)May include surrounding context.

md

The agent carries the IA method. The user supplies product knowledge in ordinary language. Never transfer professional quality-control work to a user who may not know IA.

Do not ask the user to choose Guided/Quick modes, approve jargon-heavy models, select a checkpoint, or restate “stop and wait.”

## Adaptive sufficiency loop

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The launch text logic automatically switches to Persian whenever the metadata language begins with 'fa'. This is a natural-language locale constraint embedded in code, and the file does not indicate that the user is offered a language choice or has explicitly opted into this forced language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This instruction mandates use of whatever language and writing direction are present in metadata for all human-facing text. As written, it enforces locale behavior without indicating user choice, opt-in, or justification for a mandatory language/locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The product-build requirements require the downstream system to use the metadata-defined language and writing direction for human-facing text. This is a locale policy constraint stated in natural language, but the file does not show user opt-in or explain a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 12)May include surrounding context.

text

permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The guidance gives ordinary-conversation examples only in Persian: “طبق توضیح شما”، “از شواهد فعلی چنین برمی‌آید”، and “فعلاً این فرض قابل تغییر را در نظر می‌گیرم.” This can be read as prescribing a specific language output style without explicit user opt-in or a documented region-specific reason.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This JSON schema file is in scope for SQP-1 because it is a manifest/config-style file. The language property is defined only as a generic string with minimum length 2, so the trigger/scope for valid language values is underspecified and could lead to inconsistent or unintended use across locales.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This JSON schema requires meta.language for all instances, but the file does not document any user opt-in, language choice, or justification for enforcing a locale-related setting. Under the policy rule, mandatory language constraints can be a natural-language locale policy concern when not explicitly optional or region-justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This is a JSON schema file, so SQP-1 applies. The plain string field for "trigger" provides no specificity, enumeration, or documented constraints about what constitutes a valid trigger, making it easy for downstream skill definitions to use overly broad phrases.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

At L100, the code selects Farsi labels only when the model language starts with 'fa' and otherwise forces English labels. This creates a language/locale policy concern because users supplying other locales are not offered a choice or informed that output labels will be rendered in English.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.