sdlc- get software development life cycle

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:24 AM UTC
• Version: 1.0.1

Overview

This skill is a plain SDLC guidance helper with no code execution, credential use, persistence, or hidden data handling.

Installers should expect this skill to shape responses for SDLC, Agile, Waterfall, and software project planning requests. Review the broad activation wording if you want stricter routing, but the inspected artifact is advisory content only and does not perform actions on your system.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill description contains very broad activation language covering many common SDLC and project-management topics, which increases the chance the skill will trigger in ordinary conversations that only loosely relate to its intended scope. Over-broad routing is dangerous because it can cause unintended invocation, unexpected disclosure of internal guidance, or interference with a more appropriate skill or base assistant behavior.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

2. **Methodology** - Agile (Scrum/Kanban) or Waterfall?
3. **Current Phase** - Where are they in the project right now?

If context is implicit (e.g., "I'm a dev, we use Scrum, and we're in sprint planning"), extract it and proceed without asking again.

> **Analogy (for context):** Think of SDLC like building a house. Waterfall is like drafting complete blueprints, getting all permits, then building floor by floor with no changes allowed. Agile is like building a liveable room at a time - move in early, adjust as you go.

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The command phrase list includes vague phrases such as 'Create a risk register' and 'Summarize our retrospective' that may overlap with ordinary workplace requests outside the intended skill-selection context. This creates ambiguity in invocation and can lead to accidental activation or misrouting rather than a direct security compromise.

Static analysis

No suspicious patterns detected.