ManualGen

• Outcome: Review
• Latest audit: Aug 6, 2026 · 9:51 AM UTC
• Version: 0.1.0

Overview

ManualGen is a coherent documentation skill, but it should be reviewed because it can immediately scan project code and create persistent workspace files from broad trigger phrases without a clear upfront consent step.

Install only if you want an agent to run a full manual-generation workflow over a chosen project. Use it in a clean branch or disposable working tree, keep auto_confirm disabled unless you deliberately want hands-off progression, review .agent/harness and the root manual before committing, and treat conflict exports, histories, and generated analysis as potentially sensitive project documentation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (24)

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The resolver is scoped as a documentation/manual-generation aid, but this section recommends operational actions that extend into changing application code and influencing execution flow. That scope expansion is dangerous because a documentation-oriented skill may trigger or justify real system modifications without the governance, authorization checks, or review expectations normally required for code-changing agents.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This integration allows the skill to pause modules or an entire process through a controller, which is far beyond the stated purpose of generating manuals. In an agentic environment, that creates a denial-of-service and workflow-manipulation risk: a malformed or adversarially induced conflict could halt business processes without sufficient human validation.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The file first states that P0 conflicts require manual confirmation, then later allows the system to auto-select the highest-confidence answer after 24 hours. In this skill, P0 means core business-flow contradictions, so silently resolving them can propagate incorrect workflow, approval, or data-handling instructions into generated manuals without human review.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The example history shows a P0 conflict resolved by '系统', which contradicts the earlier rule that P0 conflicts must remain pending for manual confirmation. Even as sample content, this can bias implementers or downstream agents into normalizing unsafe behavior and bypassing required review for critical inconsistencies.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The protocol broadens the skill from document generation into autonomous project exploration, codebase inspection, state-machine analysis, data-flow mapping, and staged workflow execution. Even if intended to improve manual quality, this materially increases capability scope and can cause the agent to inspect and reason over repository contents far beyond what a user may expect from a 'manual generation' skill.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The protocol requires spawning multiple sub-agents for writing and later for review/refinement, which increases autonomy and execution surface beyond the stated purpose. More autonomous agents means more opportunities for uncontrolled file access, inconsistent safety decisions, and unreviewed actions occurring without a fresh user checkpoint.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The activation keywords are broad, generic documentation phrases that can match ordinary user requests and trigger the skill outside its intended scope. Because this skill is designed to auto-run multi-stage workflow behavior with file reads/writes and minimal confirmation, unintended invocation increases the chance of unnecessary project access, unwanted artifact creation, and workflow hijacking.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The intent regex patterns are permissive and rely on loose wildcards such as '帮我.*手册', which can overmatch many benign requests and invoke the skill unexpectedly. In this skill's context, that risk is amplified because activation can lead to automatic progression, persistent state updates, and filesystem interactions without an explicit opt-in at the start.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to auto-run a multi-stage workflow, write artifacts, update a baton/state file after every phase, and continue advancing without repeated user confirmation. That creates a real safety issue because it normalizes stateful file modifications and potentially broad repository-wide actions without a clear warning, scoped consent, or per-step approval boundary.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The skill content is entirely in Chinese and does not offer a language choice or document a locale restriction, which can cause operators, reviewers, or downstream agents who do not read Chinese to misunderstand instructions or miss risky behavior. In a security review context, reduced comprehensibility weakens oversight and increases the chance that unsafe workflow requirements are adopted without proper scrutiny.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This skill is entirely written in Chinese and does not offer a language choice or state that it is restricted to Chinese-speaking operators. In a multi-user or multilingual environment, users or downstream agents may misinterpret stage-gating, confirmation requirements, or file-handling rules, which can lead to incorrect execution, bypass of intended human approval points, or unsafe document generation behavior.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrases include very common requests such as '生成文档', '更新文档', and '业务分析', which can cause the skill to activate in situations broader than the user intended. Because this skill then auto-runs a state machine and performs file operations, accidental activation can lead to unexpected analysis, persistence, and workflow changes.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The core mechanism requires automatic baton updates and file-based artifact passing, but the user-facing description does not clearly warn that activating the skill will create or modify files in the workspace. This reduces informed consent and can cause unexpected filesystem side effects in normal conversations.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: This section explicitly requires reading and, if absent, creating '.agent/harness/_baton.md' before any further interaction, making disk writes automatic and immediate. Auto-executing persistence without prior confirmation is dangerous because a simple trigger can cause unintended repository changes, pollute working trees, and overwrite workflow state.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill is designed to begin executing immediately upon activation and to write state/artifact files as part of its normal workflow, but it does not require an explicit user-facing warning or consent before modifying the workspace. This creates a real safety issue because users may trigger file creation or overwrite side effects simply by invoking the skill, especially in repositories where generated artifacts or baton files may conflict with existing content.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This workflow repeatedly writes artifacts, updates baton state, and may initialize missing state automatically, yet it does not document a mandatory warning about file creation, overwrite behavior, or rollback limitations. Because the process is iterative and automatic across phases, the chance of unintended project-state changes is higher than a one-off write, making accidental corruption, clutter, or overwriting more likely.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly instructs the agent to create and write an artifact file under the project directory, but does not require a user-facing notice or confirmation before modifying repository contents. In an automated multi-step workflow, this can lead to silent file writes, unintended overwrites, and tampering with project state, especially because the broader skill also says phases auto-advance and artifacts must be passed by file.

Natural-Language Policy Violations

Medium

• Confidence: 76% confidence
• Finding: The quality check hard-codes language output to zh-CN without user choice or documented necessity. This is not a direct code-execution issue, but it can cause unsafe misunderstandings, failed operator review, and incorrect downstream use when users, reviewers, or integrated systems expect another language.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documented rule permits silent automatic conflict resolution, meaning the skill may make unreviewed decisions and suppress user visibility. In a documentation and business-process context, silent resolution can propagate incorrect assumptions into manuals, downstream tasks, or linked workflows, especially when the resolver relies on heuristic confidence rather than authoritative approval.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The history and export features store and expose detailed conflict data, including file paths, code snippets, reasoning chains, and project metadata, but the documentation does not warn about or limit sensitive-data exposure. If used broadly, exports intended for audit could leak internal structure or proprietary implementation details to unauthorized users or less secure destinations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly directs automatic writing of generated content into the project root and enables auto-write without requiring an explicit user confirmation at the point of modification. This creates a real workspace integrity risk: an agent following these instructions could overwrite or introduce files in the repository unexpectedly, especially because the skill also mandates automatic progression and retry behavior.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The protocol explicitly instructs the agent to create and write back a baton file as part of normal execution, but provides no requirement to obtain user consent or warn that project files will be modified. In an agent skill, silent filesystem writes can surprise users, overwrite repository content, or leave unintended artifacts, especially because the protocol frames these writes as mandatory and automatic.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The protocol directs the agent to write intermediate artifacts and a final deliverable into the repository and project root, but does not require a user-facing warning, explicit consent, or safe output location. This can unexpectedly modify tracked files, pollute repositories, trigger downstream automation, or overwrite existing documentation in a way the user did not authorize.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| EXTRACT | 知识库（`_extraction.md`）已存在且项目代码无变更 | 使用已有 `_extraction.md` | 标记复用 |
| ANALYZE | `_analysis.md` + `_function_survey.md` 已存在且无代码变更 | 使用已有分析产物 | 标记复用 |
| RESOLVE | 无冲突（`_gap_analysis.md` 中 P0/P1 冲突为 0） | 直接创建 `_resolution.md` 标记"无冲突" | `_resolution.md` 内容为"无冲突" |
| CONFIRM | 用户配置了 `auto_confirm: true`（需用户提前设置） | 自动确认，记录日志 | 跳过等待 |
| WRITE | 模块文档已存在且无变更（增量模式） | 复用已有模块文档 | 标记复用 |
| TODO_RESOLVE | `_todo_list.md` 为空或所有 TODO 已 RESOLVED | 创建 `_todo_resolution.md` 标记"无待办" | `_todo_resolution.md` 内容为"无待办" |

• Confidence: 84% confidence
• Finding: auto_confirm

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.