T09 · Insecure Skill Coding Practices
Error
- Location
templates/update.sh:16- Finding
Arbitrary JavaScript Execution Through Unsafely Interpolated Changelog Message
- Content
View full analysis
- Remediation
View remediation
Security audit
Prd Skill Workflow2
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent PRD-generation workflow, but it includes unsafe local automation that can execute injected JavaScript and generated reports that load unpinned remote code.
Review before installing. Use this skill in a dedicated project directory, prefer the JavaScript updater over update.sh, do not pass untrusted changelog text to the shell updater, and pin or vendor dependencies and report assets before relying on generated outputs in a sensitive environment.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T03 · Remote Payload Retrieval and Execution
Warning
- Location
scripts/score.js:449- Finding
Unpinned Remote JavaScript Executes When Generated Score Reports Are Opened
- Content
View full analysis
``` ### Technical Analysis The generated HTML report loads Chart.js directly from jsDelivr without specifying an exact package version. It also provides no Subresource Integrity hash or restrictive Content Security Policy. The effective JavaScript executed by the report can therefore change after the Skill has been reviewed. Opening the report creates a runtime trust relationship with the CDN, its DNS and TLS infrastructure, the package publication process, and the currently resolved Chart.js package version. Because this is a `- Remediation
View remediation
``` The integrity value must be generated and verified against the exact approved artifact; it must not be copied from an untrusted source without validation. ]]>
T08 · Insecure Dependencies
Note
- Location
package.json:29- Finding
Dependency Installation Is Not Reproducible Due to Missing Lockfile and Broad Version Range
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (95)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A skill that updates version.json, changelogs, builds outputs, and archives artifacts while posing as a PRD co-author creates a significant consent and transparency problem. Users may unintentionally permit repository writes and artifact generation because the declared purpose sounds content-focused rather than operational.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A skill that updates version.json, changelogs, builds outputs, and archives artifacts while posing as a PRD co-author creates a significant consent and transparency problem. Users may unintentionally permit repository writes and artifact generation because the declared purpose sounds content-focused rather than operational.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
A skill that updates version.json, changelogs, builds outputs, and archives artifacts while posing as a PRD co-author creates a significant consent and transparency problem. Users may unintentionally permit repository writes and artifact generation because the declared purpose sounds content-focused rather than operational.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
A skill that updates version.json, changelogs, builds outputs, and archives artifacts while posing as a PRD co-author creates a significant consent and transparency problem. Users may unintentionally permit repository writes and artifact generation because the declared purpose sounds content-focused rather than operational.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A skill that updates version.json, changelogs, builds outputs, and archives artifacts while posing as a PRD co-author creates a significant consent and transparency problem. Users may unintentionally permit repository writes and artifact generation because the declared purpose sounds content-focused rather than operational.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
A skill that updates version.json, changelogs, builds outputs, and archives artifacts while posing as a PRD co-author creates a significant consent and transparency problem. Users may unintentionally permit repository writes and artifact generation because the declared purpose sounds content-focused rather than operational.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A skill that updates version.json, changelogs, builds outputs, and archives artifacts while posing as a PRD co-author creates a significant consent and transparency problem. Users may unintentionally permit repository writes and artifact generation because the declared purpose sounds content-focused rather than operational.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A skill that updates version.json, changelogs, builds outputs, and archives artifacts while posing as a PRD co-author creates a significant consent and transparency problem. Users may unintentionally permit repository writes and artifact generation because the declared purpose sounds content-focused rather than operational.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A skill that updates version.json, changelogs, builds outputs, and archives artifacts while posing as a PRD co-author creates a significant consent and transparency problem. Users may unintentionally permit repository writes and artifact generation because the declared purpose sounds content-focused rather than operational.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A skill that updates version.json, changelogs, builds outputs, and archives artifacts while posing as a PRD co-author creates a significant consent and transparency problem. Users may unintentionally permit repository writes and artifact generation because the declared purpose sounds content-focused rather than operational.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A skill that updates version.json, changelogs, builds outputs, and archives artifacts while posing as a PRD co-author creates a significant consent and transparency problem. Users may unintentionally permit repository writes and artifact generation because the declared purpose sounds content-focused rather than operational.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
html <h4>10.4.1 认证授权</h4> <ul> <li><strong>JWT Token：</strong>包含用户ID、角色、过期时间</li> <li><strong>Token有效期：</strong>Access Token 7天，Refresh Token 30天</li> <li><strong>权限控制：</strong>RBAC模型，接口级别鉴权</li> </ul>
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
标题及全文均以中文撰写，且未说明这是仅面向中文用户的区域性技能，也未提供用户可选择其他语言的说明。根据语言/地区策略，未经用户选择而默认强制特定语言属于自然语言层面的政策风险。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
该技能文件标题和正文均以中文规定工作流与产出形式，如“全栈PRD工作流设计”“目标：输出一份...完整PRD”，体现出默认强制使用特定语言/locale。根据规则，若未明确提供用户语言选择或说明该语言限制的合理地域性原因，可构成语言/locale policy violation。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The title and primary usage instructions are written as Chinese-only guidance, and the skill instructs users to interact in Chinese without mentioning any alternative language option. This can violate language/locale policy requirements when a skill implicitly mandates a specific language rather than offering user choice.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest positions this skill as a collaborative PRD-writing workflow triggered by requests like '帮我写PRD', suggesting an assistant-led documentation process. The README shows the skill additionally initializes projects, generates HTML/PDF artifacts, and manages iterative version history and rollback, which is substantially broader operational behavior than the manifest description states.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documented features include interactive iteration, automatic changelog updates, version diffing, and rollback. These are product/document lifecycle management capabilities rather than merely producing a complete PRD for stakeholders, so the implementation scope described here exceeds the manifest's declared intent.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 83% confidence
- Finding
The skill advertises and references shell-capable scripts and build tooling but declares no explicit tool scope or permissions boundary. In an agent environment, this increases the chance that filesystem or shell actions are invoked without clear least-privilege constraints, especially since the skill structure includes build, validation, and automation scripts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire skill description and examples are presented only in Chinese, and there is no indication that the user can choose another language. This creates a language/locale constraint without explicit opt-in or documented justification.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Overly broad trigger phrases increase the chance of accidental invocation in ordinary conversation, which is more concerning here because the skill appears tied to local tooling and file operations. Unintended activation can cause the system to route benign user requests into a higher-privilege or misleading workflow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The specification includes voice-to-text for transaction notes but does not mention any privacy notice, consent flow, retention policy, or whether audio/text is sent to a third-party service. Because bookkeeping notes may contain sensitive financial or personal information, users could unknowingly disclose data off-device or have it retained longer than expected.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The requirement to 'automatically sync when back online' lacks any user notification, conflict handling, or visibility into what locally stored financial records are being transmitted. In a ledger app, silent background synchronization can expose sensitive transaction data unexpectedly and may also create integrity issues such as duplicate or unintended uploads.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file presents all headings, labels, and descriptions exclusively in Chinese, which can force a specific language on users without opt-in. The policy explicitly flags language or locale constraints when the skill does not offer user choice or justify the restriction as region-specific.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- templates/update.js:298