Src

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:23 AM UTC
• Version: 1.2.0

Overview

This is a disclosed SDD workflow toolbox with purpose-aligned document and code-reading behavior, but its WebFetch/network metadata and broad trigger phrases deserve user attention.

Install only if you are comfortable with the child skills reading project files for architecture context and audit. Treat the package as Chinese-oriented, and verify or adjust the spec-writer network declaration because it can use WebFetch despite declaring no network access.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (26)

Hidden Instructions

High

• Category: Prompt Injection

Content

### 步骤 A：上下文完整性检查

检查上游产物是否包含验证标记 `<!-- CONTEXT-CHECK: ... -->`：

- 如验证标记存在且数值合理 → 继续生成
- 如验证标记缺失或数值异常 → 提示用户"上游产物可能不完整，建议确认后继续"

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

### 步骤 A:上下文完整性检查

检查上游产物是否包含验证标记 `<!-- CONTEXT-CHECK: ... -->`:

- 如验证标记存在且数值合理 → 继续生成
- 如验证标记缺失或数值异常 → 提示用户"上游产物可能不完整,建议确认后继续"

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

> 未检测到架构设计方案。请提供架构设计文本，或使用 arch-designer 基于 Spec 生成（本 SKILL 只负责任务规划，不执行架构设计）。

**上下文完整性检查**：架构设计来自当前对话时，检查是否包含验证标记 `<!-- CONTEXT-CHECK: ... -->`；缺失或异常时提示用户"上游架构设计可能不完整，建议确认后继续"。

## 执行流程

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

> 未检测到架构设计方案。请提供架构设计文本,或使用 arch-designer 基于 Spec 生成(本 SKILL 只负责任务规划,不执行架构设计)。

**上下文完整性检查**:架构设计来自当前对话时,检查是否包含验证标记 `<!-- CONTEXT-CHECK: ... -->`;缺失或异常时提示用户"上游架构设计可能不完整,建议确认后继续"。

## 执行流程

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: Natural-language policy review applies to all file types. The file appears to force a specific language for interaction and documentation, and it does not state that the skill is Chinese-only by design or provide any user opt-in or alternative language support.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| SKILL | 输入 | 产出 | 典型触发词 |
|-------|------|------|-----------|
| [spec-writer](skills/spec-writer/SKILL.md) | 需求文档 / 想法 / 已有 Spec | 结构化 Spec + 追问清单 | 解析 PRD、帮我写 Spec、检查这个 Spec |
| [arch-designer](skills/arch-designer/SKILL.md) | 已有完成的 Spec | 架构设计方案 + 风险 + ADR | 根据 Spec 做架构、设计系统架构 |
| [task-planner](skills/task-planner/SKILL.md) | 已有架构方案 | 任务清单（含验收条件、证据要求） | 把架构拆成任务、拆任务 |
| [impl-guide](skills/impl-guide/SKILL.md) | 已有任务清单 + 架构 | 实现指导规范 + 可执行测试骨架 | 生成实现指导、怎么开始写代码 |

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill advertises broad, natural-language trigger phrases such as '检查这个 Spec', '拆任务', and '怎么开始写代码' that are likely to appear in ordinary development conversations. This can cause unintended activation of the skill or misrouting to the wrong tool, increasing the chance that users receive guidance from an inappropriate phase-specific skill without explicitly requesting it.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| SKILL | 输入 | 产出 | 典型触发词 |
|-------|------|------|-----------|
| [spec-writer](skills/spec-writer/SKILL.md) | 需求文档 / 想法 / 已有 Spec | 结构化 Spec + 追问清单 | 解析 PRD、帮我写 Spec、检查这个 Spec |
| [arch-designer](skills/arch-designer/SKILL.md) | 已有完成的 Spec | 架构设计方案 + 风险 + ADR | 根据 Spec 做架构、设计系统架构 |
| [task-planner](skills/task-planner/SKILL.md) | 已有架构方案 | 任务清单（含验收条件、证据要求） | 把架构拆成任务、拆任务 |
| [impl-guide](skills/impl-guide/SKILL.md) | 已有任务清单 + 架构 | 实现指导规范 + 可执行测试骨架 | 生成实现指导、怎么开始写代码 |
| [audit-trace](skills/audit-trace/SKILL.md) | 产物 + 实现代码 | 完工审计报告（八维 + 三层门控） | 审计完成情况、完工审计、交付检查 |

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

|-------|------|------|-----------|
| [spec-writer](skills/spec-writer/SKILL.md) | 需求文档 / 想法 / 已有 Spec | 结构化 Spec + 追问清单 | 解析 PRD、帮我写 Spec、检查这个 Spec |
| [arch-designer](skills/arch-designer/SKILL.md) | 已有完成的 Spec | 架构设计方案 + 风险 + ADR | 根据 Spec 做架构、设计系统架构 |
| [task-planner](skills/task-planner/SKILL.md) | 已有架构方案 | 任务清单（含验收条件、证据要求） | 把架构拆成任务、拆任务 |
| [impl-guide](skills/impl-guide/SKILL.md) | 已有任务清单 + 架构 | 实现指导规范 + 可执行测试骨架 | 生成实现指导、怎么开始写代码 |
| [audit-trace](skills/audit-trace/SKILL.md) | 产物 + 实现代码 | 完工审计报告（八维 + 三层门控） | 审计完成情况、完工审计、交付检查 |

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| [spec-writer](skills/spec-writer/SKILL.md) | 需求文档 / 想法 / 已有 Spec | 结构化 Spec + 追问清单 | 解析 PRD、帮我写 Spec、检查这个 Spec |
| [arch-designer](skills/arch-designer/SKILL.md) | 已有完成的 Spec | 架构设计方案 + 风险 + ADR | 根据 Spec 做架构、设计系统架构 |
| [task-planner](skills/task-planner/SKILL.md) | 已有架构方案 | 任务清单（含验收条件、证据要求） | 把架构拆成任务、拆任务 |
| [impl-guide](skills/impl-guide/SKILL.md) | 已有任务清单 + 架构 | 实现指导规范 + 可执行测试骨架 | 生成实现指导、怎么开始写代码 |
| [audit-trace](skills/audit-trace/SKILL.md) | 产物 + 实现代码 | 完工审计报告（八维 + 三层门控） | 审计完成情况、完工审计、交付检查 |

> **TEST-SKELETON-SPEC.md**：测试骨架规范（V-01~V-04），被 impl-guide / task-planner / audit-trace 引用，随本包分发，需与其保持同目录。

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| [arch-designer](skills/arch-designer/SKILL.md) | 已有完成的 Spec | 架构设计方案 + 风险 + ADR | 根据 Spec 做架构、设计系统架构 |
| [task-planner](skills/task-planner/SKILL.md) | 已有架构方案 | 任务清单（含验收条件、证据要求） | 把架构拆成任务、拆任务 |
| [impl-guide](skills/impl-guide/SKILL.md) | 已有任务清单 + 架构 | 实现指导规范 + 可执行测试骨架 | 生成实现指导、怎么开始写代码 |
| [audit-trace](skills/audit-trace/SKILL.md) | 产物 + 实现代码 | 完工审计报告（八维 + 三层门控） | 审计完成情况、完工审计、交付检查 |

> **TEST-SKELETON-SPEC.md**：测试骨架规范（V-01~V-04），被 impl-guide / task-planner / audit-trace 引用，随本包分发，需与其保持同目录。
>

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: 该文件标题及全文内容均以中文撰写，且未说明这是特定区域/合规场景限定，也未向用户提供语言或本地化选择。根据规则，强制特定语言而没有用户选择或明确正当理由，属于自然语言层面的语言/地区策略违规。

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The positive trigger set includes short, generic phrases such as '设计系统架构' and '出架构方案' that are plausible in ordinary conversation and may cause over-broad routing to this skill. In an orchestration system, overly permissive trigger examples can lead to unintended invocation, misrouting user requests away from the correct skill boundary, and downstream policy or workflow bypass if the wrong skill handles inputs it should not.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The manifest description is written entirely in Chinese and the skill file provides no indication that users may choose another language or locale. Per the policy, a skill that effectively enforces a specific language without opt-in should be flagged unless the locale constraint is explicitly justified.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The positive trigger set includes very broad natural-language phrases such as '审计完成情况' and '检查需求做完了吗' that can appear in ordinary project conversations without the user intending to invoke this specific skill. In a routing system, overly generic triggers increase the chance of accidental activation, misrouting user requests, and downstream behavior being applied in the wrong context.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: Several listed triggers are underspecified phrases like '交付检查', '验收检查', and '审查测试结果', which are common across many development workflows and could match other skills or normal chat. Because this file defines evaluation expectations, these broad examples can normalize imprecise routing behavior and cause the audit skill to intercept requests that belong to planning, implementation, QA, or deployment flows.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The manifest description is written as a fixed Chinese-language behavior statement and does not indicate that the user may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The positive trigger set includes broad, natural-language phrases such as '怎么开始写代码', '这个任务的实现步骤', and '测试要求是什么', which can match many ordinary development conversations outside the intended scope of this skill. In a dispatcher or routing system, this increases the chance of unintended invocation, causing the wrong skill to activate and potentially bypass boundary controls such as requiring an upstream task list before producing implementation guidance.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The description is written as a Chinese-only capability statement and specifies the skill's input/output behavior entirely in Chinese, with no indication that users may choose another language. This creates a language/locale policy concern because the skill appears to impose a specific language rather than offering user choice or documenting a justified regional constraint.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest claims `network: none`, but the skill explicitly requires `WebFetch` and accepts webpage content via fetching before processing. This mismatch can mislead operators, policy engines, or sandboxing controls about the skill’s true capabilities, resulting in unintended outbound access or incorrect trust decisions.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill states it only accepts text input, yet it also directs exploratory scanning of the project/codebase using repository inspection and module discovery. This expands the effective data-access scope beyond user-provided text, which can cause over-collection of local context, accidental exposure of sensitive code/configuration, and behavior that users or enforcement systems did not expect.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The positive trigger set includes broad, everyday phrases such as '整理需求文档' and '审查 proposal' that are not uniquely tied to spec-writing behavior. In a skill-routing system, these ambiguous triggers can cause unintended invocation of this skill, leading to misrouting, boundary violations with adjacent skills, and incorrect processing of user requests.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This markdown file contains natural-language guidance stating "当前仅支持中文" in the Out-of-Scope example. That language constrains locale/language support and does not offer the user a choice or explain a region-specific compliance need, which matches the policy-violation category for forced language/locale behavior.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This JSON file defines the skill purpose, trigger examples, assertions, and checks entirely in Chinese, including expected user inputs such as "拆任务" and "制定迭代计划", which implies the skill is designed to activate and be evaluated only for Chinese-language phrasing. There is no natural-language indication that users may choose another language or that the locale restriction is intentional and justified, which matches the policy-violation criterion for forced language/locale behavior.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: The file's purpose, trigger examples, and checks are entirely written in Chinese, with no indication that language choice is optional or tied to a justified region-specific constraint. This can be a locale-policy concern if the skill is expected to operate across languages without explicit user opt-in.

Static analysis

No suspicious patterns detected.