Value Proposition Canvas

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:02 AM UTC
• Version: 0.1.0

Overview

The skill has a legitimate workshop purpose, but it asks agents to persist verbatim research evidence to user-chosen files with inconsistent path rules and weak privacy safeguards.

Install only if you are comfortable with the agent creating workshop files that may contain verbatim customer or interview quotes. Use a dedicated project directory, avoid absolute paths outside the workspace, check for existing files before writing, and redact secrets, personal data, private URLs, customer names, Slack content, and proprietary details before giving research material to the skill.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:133

Finding

Unrestricted Output Paths and Predictable File Overwrite Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:133-158, SKILL.md:480
Vulnerability Type: Unrestricted file write destination and unsafe overwrite behavior
Risk Level: Medium

Vulnerable Code

markdown

Before anything else, the agent asks the user **explicitly** where to save the three files. The agent **does not** auto-pick a location. The agent **does not** proceed without an answer. The agent **does not** assume a default. The agent **does not** write any file until the user has answered with a path.

- The user can give any path — relative, absolute, a new directory, or a name like `vpc/`.
- If the user types `skip multi-file`, the agent writes only `vpc-result.md`.
- If the user's path does not exist, the agent asks: *"The path [path] does not exist. Should I create it?"* The agent does not auto-create directories.

The same file later introduces contradictory default behavior:

markdown

### Default path

If the user does not specify a path in Step 0, the agent saves the three files to the **current working directory**. The user can override with any valid directory path.

Technical Analysis

The Skill accepts any user-provided relative or absolute output path and directs the agent to write predictable filenames such as vpc-result.md and shadow-backlog.md. It does not require the agent to:

• Canonicalize the requested path.
• Restrict output to the active project workspace.
• Reject .. path traversal.
• Reject absolute paths outside an approved directory.
• Detect symbolic links.
• Check whether a destination file already exists.
• Obtain explicit confirmation before replacing an existing file.
• Use exclusive file creation or another atomic no-clobber mechanism.

Consequently, an attacker who controls the conversation can direct a filesystem-capable agent to a writable location outside the intended project. Predictable filenames also allow a pre-positioned sym ...[truncated 1646 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict output to the active workspace or an explicitly configured artifact root.
2. Resolve the requested path to its canonical form and verify that it remains beneath the approved root.
3. Reject traversal components and out-of-workspace absolute paths.
4. Use lstat-equivalent checks on the destination directory and files; reject symbolic links unless explicitly authorized.
5. Before every write, check whether the target already exists and show the exact canonical target to the user.
6. Require explicit overwrite approval for each existing file, or generate a unique versioned filename.
7. Use atomic writes with exclusive creation where available.
8. Remove the contradictory current-working-directory fallback at line 480. Step 0 should either always require a path or clearly define one safe, workspace-confined default.
9. Log the canonical destination and overwrite decision in the workshop record.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:400

Finding

Mandatory Verbatim Transcript Persistence Without Sensitive-Data Sanitization

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:400-417; related requirements at SKILL.md:71 and references/methodology-vpc.md:190-196
Vulnerability Type: Plaintext persistence of potentially sensitive research data
Risk Level: Medium

Vulnerable Code

markdown

- **Every claim has a verbatim source quote.** A Pain without a quote is a `Hypothesis` (still added, labeled, not deleted).

The artifact-writing instructions state:

markdown

### File 1: `vpc-result.md` (the workshop source-of-truth)

The **primary artifact** the agent writes during the workshop. Contains:

- The full Customer Profile (Jobs, Pains, Gains with verbatim source quotes).
- The full Value Map (Pain Relievers, Gain Creators, Products & Services, all with one-sentence mechanisms).
- The framework selection (Kano / RICE / MoSCoW / etc.).
- Workshop log (gates passed, dates, notes).
- Evidence log (every claim sourced).
- Open Questions (money-shot, take to real customers).
- Locked vs Hypotheses (1/5 support items needing more evidence).

**When written:** during the workshop, by the agent, at each gate.

The methodology reinforces preservation of the source text:

markdown

1. **Verbatim quotes are never summarized away.** The agent preserves the original phrasing, even if it costs tokens. A summarized quote is a hallucinated quote. If the agent cannot fit a full quote in the running canvas, it keeps the full quote in a separate notes section, not in the canvas table.

Technical Analysis

Interview transcripts, support tickets, observation notes, and persona documents frequently contain personal data, confidential client information, internal project names, private URLs, email addresses, access tokens, or other secrets. The Skill mandates that excerpts be preserved verbatim and written into durable Markdown artifacts, but it provides no operational controls for:

• Secret detection.
• Per ...[truncated 2081 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a mandatory privacy and secret-scanning stage before displaying or writing any quotation.
2. Detect and redact common sensitive values, including credentials, tokens, email addresses, phone numbers, private URLs, account identifiers, and customer names.
3. Replace direct identifiers with stable pseudonyms while preserving the evidentiary meaning of the quotation.
4. Present each sanitized quotation to the user and require explicit approval before persistence.
5. Store source references separately from public-facing excerpts where possible.
6. Warn when the selected output directory is inside a version-controlled or synchronized workspace.
7. Mark generated artifacts as confidential by default unless the user completes a public-release review.
8. Add a final privacy gate that checks all artifacts for secrets, personal data, and private workspace context.
9. Document retention and deletion procedures for research artifacts.
10. Permit faithful redaction: clarify that removing sensitive identifiers does not violate the verbatim-evidence requirement when the redaction is visibly marked.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md

- `legible-agent-output` (this repo) — applies to every user-facing string the agent emits during the workshop.
---
title: Value Proposition Canvas — Methodology
version: 2.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · examples/research-ingestion.md (reported line 1)May include surrounding context.

md

- `legible-agent-output` (this repo) — applies to every user-facing string the agent emits during the workshop.
---
title: Value Proposition Canvas — Methodology
version: 2.0

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/methodology-vpc.md (reported line 1)May include surrounding context.

md

- `legible-agent-output` (this repo) — applies to every user-facing string the agent emits during the workshop.
---
title: Value Proposition Canvas — Methodology
version: 2.0

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/methodology-vpc.md (reported line 137)May include surrounding context.

md

- Their intuition is honored.
- The label makes the gap visible.
- A concrete path to lock the field.
- No moral judgment on the lack of evidence.

**When to escalate to a hard stop:**

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger list mixes specific phrases like "value proposition canvas" with broader phrases such as "build a value proposition" and "pick a prioritization framework." Those broader phrases can overlap with adjacent tasks the README itself says are out of scope, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

- feature prioritization (use kano-model-strategist — that is the next step, not this skill)
    - full go-to-market strategy (use a GTM skill)
license: MIT
model: Claude Sonnet 4.5
compatibility: |
  Tested with Claude Sonnet 4.5 (Claude Code).
  Designed for Claude Code, Codex, VS Code, OpenCode, Cursor, GitHub Copilot.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to persist user research, including verbatim source quotes and evidence logs, into output files. Research transcripts and support artifacts often contain personal, confidential, or commercially sensitive information, so preserving them in plain text materially increases data retention and leakage risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill gives mutually inconsistent instructions about save-path handling: one section says the agent must not assume a default path and must wait for an explicit user answer, while another later states that if the user does not specify a path it should save to the current working directory. This ambiguity can cause unintended file writes to sensitive or unexpected locations, especially in agent environments with broad filesystem access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill authorizes the agent to create and update multiple files containing workshop artifacts, evidence logs, and quotes, but the up-front warning about the consequences of writing user data is not strong or centralized. Users may not fully understand that sensitive research content will be persisted to disk in plain-language files, increasing the risk of accidental retention, exposure, or syncing into other systems.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This section explicitly directs the agent to write workshop logs, evidence logs, and verbatim source quotes into persistent files, which can preserve sensitive source material beyond the active session. Because these files are intended as ongoing artifacts, the retention window and audience broaden, increasing the chance of unauthorized disclosure or accidental reuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Conflicting path-selection instructions create behavioral ambiguity around when and where files may be saved. In agentic systems, ambiguous write conditions are risky because different runtimes may resolve the conflict differently, potentially creating files in unintended directories or proceeding without meaningful user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs users to collect and later provide transcripts, capture templates, screenshots, Figma files, Slack threads, and links to artifacts, but it does not warn about consent, minimization, redaction, retention, or handling of personal/confidential data. In a research workflow, those materials commonly contain PII, private communications, and proprietary product information, so the omission creates a realistic privacy and data-governance risk even if the skill's functional goal is legitimate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to ingest interview transcripts, notes, and quotes, which commonly contain personal, confidential, or otherwise sensitive research data, yet it provides no privacy handling guidance, minimization rules, or warning to the user. In an agent setting, this can normalize bulk processing of sensitive material and increase the risk of unnecessary retention, disclosure in outputs, or inclusion of direct quotes that reveal identities or confidential business context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

In Step 0, the prompt tells the user the workshop 'will produce three files,' which implies the agent will create all three outputs. Later, the document explicitly says value-proposition.md is 'not written by the agent' and repeats 'I will not write the UVP,' creating a direct contradiction in the workflow documentation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The Step 6 section first says 'The skill produces three files,' but item 3 immediately states value-proposition.md is 'not written by the agent.' The parting message then reinforces that only two files were actually written, so the documentation conflicts about the agent's actual output behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

Earlier sections frame the skill as ending at framework selection with only vpc-result.md saved, and explicitly say the agent does not create value-proposition.md and that multi-file behavior is downstream or user-owned. In L0985-L0994, the methodology adds agent behavior to create shadow-backlog.md at workshop end, expanding the artifact-writing behavior beyond the earlier declared end state and creating an internal contradiction about what the skill itself outputs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

L0205-L0211 instructs the agent that for large evidence it should ask the user to pre-summarize, while L0226-L0228 directly says that when the user brings more than 6 transcripts, the agent does not ask the user to pre-summarize all of them first and starts chunked extraction. These are conflicting operational instructions about the same scenario, creating intent-code divergence in the methodology itself.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Lines L059-L061 state that the workshop produces a single Markdown artifact, and L014 similarly describes a durable artifact such as vpc-result.md. However, L140 says v2.1 added a multi-file output structure including vpc-result.md, shadow-backlog.md, and value-proposition.md. These statements conflict about whether the skill outputs one file or multiple files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The generated artifact structure includes the heading "Dalsza lektura" while the rest of the README is in English, and there is no stated user opt-in or locale selection. This creates a mild language consistency and locale policy concern because the skill appears to impose a non-default language element in output.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill tells the agent to write files into a user-specified directory without any guardrails about overwriting existing files, path validation, or describing filesystem side effects. In practice this can lead to accidental clobbering of project files or writing sensitive summaries into unintended locations, especially when the destination path is provided dynamically.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file says it is organized as 'six layers' and repeats that framing in several places, but the body clearly contains Layer 1 through Layer 7. This is not merely incomplete documentation; it actively misstates the structure the agent is supposed to follow.

Content

No source excerpt is available for this finding.