T09 · Insecure Skill Coding Practices
Error
- Location
templates/update.sh:51- Finding
Arbitrary Code Execution Through Update Message Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
PRD FullStack Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent PRD-writing workflow, but its included build/version scripts have unsafe file-writing and code-injection risks that users should review before installing.
Install only if you are comfortable with a Chinese-language PRD workflow that ships local build and versioning scripts. Before running update.sh or generated project scripts, review and harden the handling of release messages and version.json filename fields, and run them only in a trusted project directory with reviewed inputs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
templates/build.js:15- Finding
Path Traversal and File Overwrite Through Unvalidated Version Metadata
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (75)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Version management, changelog editing, backups, and artifact generation are operational release activities, not ordinary PRD discussion functions. Bundling these undisclosed actions into a skill triggered by common PRD requests could lead to unintended repository mutations and accidental release-side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Version management, changelog editing, backups, and artifact generation are operational release activities, not ordinary PRD discussion functions. Bundling these undisclosed actions into a skill triggered by common PRD requests could lead to unintended repository mutations and accidental release-side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Version management, changelog editing, backups, and artifact generation are operational release activities, not ordinary PRD discussion functions. Bundling these undisclosed actions into a skill triggered by common PRD requests could lead to unintended repository mutations and accidental release-side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Version management, changelog editing, backups, and artifact generation are operational release activities, not ordinary PRD discussion functions. Bundling these undisclosed actions into a skill triggered by common PRD requests could lead to unintended repository mutations and accidental release-side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Version management, changelog editing, backups, and artifact generation are operational release activities, not ordinary PRD discussion functions. Bundling these undisclosed actions into a skill triggered by common PRD requests could lead to unintended repository mutations and accidental release-side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Version management, changelog editing, backups, and artifact generation are operational release activities, not ordinary PRD discussion functions. Bundling these undisclosed actions into a skill triggered by common PRD requests could lead to unintended repository mutations and accidental release-side effects.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
html <h4>10.4.1 认证授权</h4> <ul> <li><strong>JWT Token：</strong>包含用户ID、角色、过期时间</li> <li><strong>Token有效期：</strong>Access Token 7天，Refresh Token 30天</li> <li><strong>权限控制：</strong>RBAC模型，接口级别鉴权</li> </ul>
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire collaboration guide is written in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The title and content are entirely written in Chinese and present the workflow as the default operating mode, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The README advertises automatic document generation and version management but does not clearly disclose that the skill may create or modify files, which can lead users to authorize actions without informed consent. In a workspace with scripts and templates, hidden write behavior raises the risk of unintended file changes, clutter, overwrites, or execution of downstream build/update workflows.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrases are generic product-work terms that can easily appear in normal conversation, increasing the chance the skill activates unexpectedly and takes over a session without clear user intent. In an agent ecosystem, overly broad activation can cause unintended prompt injection surface expansion, accidental workflow execution, or generation of large project artifacts when the user did not explicitly request this specific skill.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill advertises workflow behavior that references shell-capable build and packaging operations, yet the manifest excerpt shown here declares no explicit tool restrictions such as allowed-tools or permissions. Unscoped code-execution capability increases the chance that a user-triggered documentation task could perform unintended filesystem or shell actions beyond normal conversational PRD assistance.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrases are broad enough to match ordinary product discussions, increasing the chance of accidental activation. In the context of a skill that appears to have undisclosed file/build capabilities, unintended invocation materially raises risk because it may expose shell or workspace actions when the user only wanted general advice.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
A trigger list without boundary conditions makes activation scope ambiguous and can cause the skill to run in contexts outside its intended use. Because the broader file suggests nontrivial build or filesystem behavior, ambiguous activation increases the probability of accidental execution of side-effecting operations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file presents the checklist and usage instructions entirely in Chinese, beginning with the title and description. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The specification includes voice-input-to-text and automatic offline-to-online synchronization, both of which can transmit potentially sensitive financial and behavioral data, but it provides no notice, consent flow, or privacy controls. In a ledger app, notes, timestamps, categories, and voice content may reveal highly personal information, so silently collecting or transmitting this data creates privacy and compliance risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The entire skill file is written in Chinese and does not indicate that language selection is optional or that the skill is region-specific. Under the policy criteria, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file documents storage of login IP address and user agent in the login_log table, and later defines analytics events for page views, clicks, failures, and lockouts. Under the markdown-specific warning rule, data/privacy-affecting behavior should be accompanied by an explicit warning or disclosure, but none is present in the document.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The file specifies password login over HTTPS and multiple telemetry/security events, which affect user privacy and sensitive data handling. Although HTTPS is mentioned, there is no explicit user warning or disclosure that credentials are transmitted to the service and that login activity is logged/monitored.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description states the skill is a Chinese-language PRD collaboration workflow ("全栈PRD协作工作流 - 与用户共同探讨，产出完整的PRD文档") with no indication that users may choose another language or locale. This creates a natural-language policy concern because it appears to impose a specific language by default rather than offering an explicit opt-in or documented regional justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
A language policy issue applies across all file types when a skill forces a specific language without user opt-in. This file's instructions and examples are exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file contains natural-language instructions exclusively in Chinese, including the role, workflow, and example dialogue. Under the policy rule, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly justified or optional.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown skill specifies all prompts and instructions in Chinese, which effectively forces a specific language for interaction. The policy allows language constraints only when the skill offers user opt-in or clearly documents a justified locale-specific scope, neither of which is present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown prompt requires interaction in Chinese throughout, but it does not state that Chinese is optional or limited to a justified region-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The prompt is written entirely in Chinese and provides no mechanism to detect or honor the user's preferred language. This can exclude users, cause misunderstanding of requirements, and lead to incorrect PRD output if a user expects another language, especially in collaborative planning workflows where precision matters.
- Content
Static analysis
No suspicious patterns detected.