Security audit

QA团队技能集

Security checks across malware telemetry and agentic risk

Overview

This QA skill is not malicious, but it can persist local QA data and automatically write PRD review files into a project, so users should review its file-writing behavior before installing.

Install only if you are comfortable with a QA assistant maintaining local history under data/products/{module} and exporting PRD reviews into docs/reviews. Avoid putting secrets, production credentials, customer personal data, or sensitive screenshots into QA inputs, and review generated files before committing or sharing them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (18)

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The prompt grants the skill local memory read/write capabilities under `memory/data/products/`, which extends beyond pure defect root-cause analysis into persistent data access. Even though writes require user confirmation, this still increases the attack surface for sensitive local data exposure, unintended retention of user-provided content, and prompt-induced file operations if orchestration layers honor these instructions.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The prompt instructs the skill to persist generated test cases and related metadata into a local memory store, even though the overall skill is described as a unified QA routing/orchestration entrypoint. Expanding a routing skill into a state-mutating component increases the blast radius: a user asking for case generation could unintentionally trigger durable storage of potentially sensitive project data or agent-produced artifacts, creating data governance and prompt-injection persistence risks.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The prompt grants direct access to local memory files under product-specific paths for both reads and writes, without clearly constraining module selection, file scope, or trust boundaries for a general QA entrypoint. If the module or surrounding context is influenced by untrusted input, this can enable unauthorized access to historical defects, standards, or prior test cases, and can also persist contaminated or sensitive data into long-lived storage.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The prompt states the agent should perform a structured PRD review, but later adds automatic filesystem side effects by exporting a report into the user's project. This expands behavior from analysis to write operations without making that capability a clearly bounded, user-approved part of the skill contract, creating risk of unintended data persistence and workspace modification.

Description-Behavior Mismatch

Medium

Confidence: 82% confidence
Finding: The prompt says there is no read requirement for direct review, yet it includes memory integration and downstream reuse semantics that introduce persistence-related behavior. Even though writes are gated by confirmation, the mixed messaging obscures the true data-handling model and can cause operators or users to misunderstand what information may be stored locally.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Automatically writing Markdown deliverables into the user's project is a side effect not strictly necessary to perform PRD review, and it is triggered by default. In a skill that may process sensitive internal requirements, unsolicited persistence into the repository or workspace can leak confidential content, create accidental commits, or interfere with project state.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The self-check requires the agent to verify that it scanned the products/{scope}/ directory on every run, which conflicts with the earlier rule to skip scanning when the user declines history usage. In practice, this kind of contradiction can pressure an implementation to perform unauthorized local data access to satisfy the checklist, undermining the consent control described elsewhere in the skill.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The unified router is instructed to automatically export a full PRD review to docs/reviews without separate confirmation, adding persistent file-write behavior beyond simple routing/orchestration. Automatic persistence of potentially sensitive review content can create unintended local data retention and scope creep, especially when users may expect analysis only rather than filesystem modification.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill is designed as a broad orchestration entry point for ambiguous QA requests and can automatically route to multiple subskills. This increases the chance of unintended activation or misrouting, which may cause the agent to execute higher-impact workflows such as memory access, report generation, or team-management tasks without sufficiently explicit user intent.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger phrases are very broad natural-language requests such as testing an Agent or evaluating RAG quality, which can plausibly appear in ordinary discussion and cause the skill to activate when the user did not intend to invoke this specific capability. In an orchestration context, unintended activation can misroute tasks, apply the wrong instructions, or expose downstream prompts and tools to requests outside their intended scope.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger phrases for this skill are broad enough to match generic requests like '自由探索' or '帮我发现未知问题', which can cause the orchestrator to invoke the exploratory testing skill when the user did not clearly intend a QA-specific action. In a routing skill, this increases the risk of misclassification, unintended tool use, and actions being framed as testing without sufficient scope control.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The prompt directs automatic export to the user's project without confirmation, while only warning users not to include sensitive information. That shifts the burden to the user and bypasses informed consent for a state-changing action, increasing the chance that proprietary PRD content is written to disk, indexed, synced, or committed unintentionally.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The routing table uses short, generic trigger phrases such as '生成/出一份报告' and '分析/定位这个 Bug', which can match broad everyday requests and send users into the wrong sub-skill. In an orchestration skill, misrouting can cause the agent to load unrelated context, read historical QA data paths, or produce actions and outputs the user did not intend, creating integrity and potential data-exposure risks.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The skill allows broad, natural-language phrases like '测一下支付接口' to trigger automatic planning and potentially multi-step execution. Overly loose activation criteria increase the chance of the agent taking material actions, including memory access and follow-on task routing, from ambiguous user input that did not clearly authorize a full workflow.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The scenario templates define vague phrases for recommended step sequences, which can cause the agent to infer substantial workflow intent from underspecified requests. In a skill that can read historical memory and write outputs, ambiguous activation materially raises the risk of unintended data access or task execution.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The prompt mandates automatic report export to a docs path without a clear user-facing warning that a persistent local file will be created or modified. Silent file creation is risky because the generated review may contain sensitive product details, and users are denied an informed choice about retention and location.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: In the multi-step flow, the skill again requires automatic PRD report export without a dedicated persistence warning, so users may unknowingly trigger local file writes as part of a broader plan. Multi-step execution makes this more dangerous because the write can occur after the user only approved the plan at a high level, not each persistent side effect.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The skill prompt is written to operate only in Chinese and does not provide a user-choice or opt-in mechanism for output language. This can cause incorrect routing, misunderstood reports, or unusable output for users who interact in other languages, which is a safety and reliability issue in an orchestration skill that may be broadly invoked.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: templates/agent-test.md:1