Security audit

SDD Brainstorming

Security checks for vulnerabilities and agentic risk

Overview

The skill is a legitimate design-planning workflow, but it can broadly take over coding tasks and launch unbounded background image generation after writing project files.

Install this only if you want a mandatory design-first workflow for feature work. Before using it, check that .sdd-workspace points to the intended project, review any proposed spec overwrite carefully, and consider disabling or constraining background image generation if unexpected files or resource use would be a problem.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: 该技能声明“在实现任何新功能、构建组件、添加功能或修改行为之前必须使用”，触发范围几乎覆盖所有常见开发请求，容易在用户未明确同意时拦截并重定向正常任务流。由于技能后续还包含文件扫描、读取、写入和后台子代理生成等副作用，过宽触发会放大这些操作被不必要执行的概率。

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: 技能要求直接写入或覆盖 `{workspace}/spec/.../spec-design.md`，对于已有文档仅要求展示变更摘要并确认，但没有清晰、前置、显式的数据变更风险提示。若用户未充分理解覆盖行为，可能造成规格文档被静默重写、历史内容丢失或工作区污染。

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: 技能要求在主流程结束后启动后台子代理批量生成图片并保存到工作区，但没有将这一额外文件写入行为作为独立风险向用户清楚披露。后台异步执行且主流程不等待，会降低用户对实际副作用范围的感知，可能导致意外生成大量文件或占用资源。

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: 强制“用中文写设计文档”会在未征得用户同意的情况下改变输出语言，可能导致与项目既有语言规范、团队协作要求或合规记录要求不一致。虽然这更偏向流程与可用性风险，但在需要特定语言留档的环境中会造成误沟通或文档不可用。

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: 模板再次将中文设为固定要求，强化了缺乏语言选择的问题，使语言偏好从建议变成不可绕过的输出约束。结合该技能会自动写入文件，这意味着不匹配语言的文档会被直接落盘到项目中。

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: 在关键原则中把“设计文档始终用中文撰写”设为绝对规则，进一步降低了代理根据上下文遵循用户语言和仓库规范的能力。该类强制约束本身不是高危安全缺陷，但会增加错误写入不合规文档的概率，尤其在多语言或英文规范项目中。

Static analysis

No suspicious patterns detected.