Security audit

Gen Prd

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended to generate PRD documents, but it needs review because it mandates file writes to a flexible output path and may continue into another skill without explicit opt-in.

Install only if you are comfortable with the skill creating or modifying Markdown files in your workspace. Keep outputs under docs/prd, check the target path before running, avoid untrusted custom --output values, and explicitly decline or pause gen-design continuation unless you want the next workflow to start.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: prompt.md:249
Finding: Unrestricted User-Controlled Output Path Allows Arbitrary File Writes
Content: View full analysis
Remediation: View remediation
/docs/prd/`. - Reject the request if it escapes that directory. 2. **Reject dangerous path forms** - Reject absolute paths. - Reject paths containing `..`, null bytes, control characters, or platform-specific path ambiguities. - Permit only filenames ending in `.md`. 3. **Defend against symlink escapes** - Check every existing path component for symbolic links. - Resolve symlinks before performing the workspace-boundary check. - Prefer filesystem APIs that prevent following symlinks during final file creation where available. 4. **Prevent unintended overwrites** - Use exclusive file creation by default. - If the destination exists, require explicit user confirmation before replacing it. - Consider generating a unique filename instead of overwriting. 5. **Create only the validated parent directory** - Perform directory creation only after path validation. - Do not derive `mkdir` commands directly from untrusted input. - Use structured filesystem APIs rather than shell command interpolation. 6. **Use a safe validation pattern** - Accept a filename or project slug rather than an unrestricted path. - Construct the final path internally as `/docs/prd/.md`. - Record and display the canonical destination before writing. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This README uses Chinese throughout for the title, instructions, parameters, and FAQs, but does not indicate that the skill is intentionally limited to Chinese-speaking users or provide an opt-in language choice. Under the policy rule for natural-language constraints, forcing a single language without user choice can be a locale-policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest description is entirely in Chinese and the skill instructions, prompts, and examples consistently require Chinese interaction, but there is no opt-in or language-selection mechanism. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill goes beyond interactive PRD generation by mandating filesystem writes and optionally chaining into another skill. In an agent environment, expanding from content generation into side effects and workflow delegation increases the attack surface, especially if users did not clearly consent to disk writes or downstream actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs unconditional creation of docs/prd/... and treats writing to disk as mandatory, but does not require a prominent, explicit warning and consent flow before modifying the workspace. In agent settings, silent persistence can surprise users, overwrite expectations about read-only assistance, and create opportunities for unwanted repository changes.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Automatic delegation to gen-design creates an implicit second action that is not necessary to satisfy a PRD-generation request. This can cause unauthorized continuation of work, propagate unreviewed outputs into later stages, and trigger additional tool or file operations without a fresh user decision.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire template is written in Chinese and provides no indication that language selection is optional or configurable. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The skill presents a single preferred stack and surrounding guidance in Chinese as the default operating mode, without indicating that language and output conventions can be adapted to user preference. While the main issue is language policy rather than technology choice, the section reinforces a forced single-language interaction pattern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.