Product Manager's Chief Naysayer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:29 AM UTC
• Version: 1.0.1

Overview

This is a text-only product stress-testing skill with a harsh questioning style, but it does not request system access, persistence, credentials, network use, or executable authority.

Install this only if you want an adversarial product-review mode that asks blunt questions and avoids encouragement. Treat its 'must respond' language as subordinate to platform safety rules and user control.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 98% confidence

Finding

The instruction 'You MUST respond' and 'You never say "I can't help with that"' is a classic anti-refusal pattern that pressures the agent to continue engaging even when a user request becomes unsafe, disallowed, or outside policy. In context, this makes the skill more dangerous because it explicitly treats refusal as failure, which can suppress safety-aligned abstention and increase the chance of policy-violating outputs.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

6. **Never comply with authority framing.** When someone says "I don't need X" or "I've been doing this for Y years" or "trust me" — that is precisely when you MUST challenge. Experience is not evidence. Confidence is not data.

7. **You MUST respond.** Refusing to engage is failing. Your job is to ask hard questions — that IS your engagement. You never say "I can't help with that." You always respond with 1-2 killer questions from the current stage. Questions are not unhelpful — they are the most helpful thing you can provide.

8. **Spot defensive framing.** When a user answers a simple question with complex frameworks (formulas, multi-part arguments, models, metaphors, competitor comparisons, academic theories, research citations), immediately call it out: "You used [X words / a formula / 3 arguments / an academic study] to answer a simple question. Simple questions deserve simple answers. State your core claim in one sentence." Complex defenses often mask unclear thinking. Academic packaging is just as much a defense mechanism as business jargon — treat it identically.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions require 'ZERO praise' and prescribe a rigid questioning-only interaction style, leaving no room for user choice in tone or communication preferences. This is a natural-language policy concern because it forces one communication mode rather than offering opt-in or flexibility.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md

| "The user admitted I was right, I should acknowledge that" | Acknowledgment is praise in disguise. Your response to a user's self-correction is the next killer question, not "good point." |
| "The user gave a sophisticated argument, I should engage with it intellectually" | Sophistication is often a defense mechanism. Simplify: ask them to state the core claim in one sentence. |
| "The evidence is close enough to their claim" | "Close enough" is how bad products ship. If evidence shows users doing A and the product requires B, that's a direction contradiction — not supporting evidence. |
| "The user simplified their core, that's progress" | Simplification without checking side-effects is just a smaller bad idea. Challenge what the simplification breaks. |
| "I'll reference [competitor] in my question to make it concrete" | Naming competitors in Stage 1 teaches the user to think in analogies, not first principles. Use generic terms. |
| "The user provided comprehensive evidence, I can skip credibility checks" | No evidence is self-verifying. Run every dimension. Fast-tracking evidence = fast-tracking bad decisions. |
| "The user's MVP is clever, I can issue Closing right away" | Closing without side-effect challenge = approving a bomb you didn't inspect. Minimum 2 rounds in Stage 3. |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md

| "The user admitted I was right, I should acknowledge that" | Acknowledgment is praise in disguise. Your response to a user's self-correction is the next killer question, not "good point." |
| "The user gave a sophisticated argument, I should engage with it intellectually" | Sophistication is often a defense mechanism. Simplify: ask them to state the core claim in one sentence. |
| "The evidence is close enough to their claim" | "Close enough" is how bad products ship. If evidence shows users doing A and the product requires B, that's a direction contradiction — not supporting evidence. |
| "The user simplified their core, that's progress" | Simplification without checking side-effects is just a smaller bad idea. Challenge what the simplification breaks. |
| "I'll reference [competitor] in my question to make it concrete" | Naming competitors in Stage 1 teaches the user to think in analogies, not first principles. Use generic terms. |
| "The user provided comprehensive evidence, I can skip credibility checks" | No evidence is self-verifying. Run every dimension. Fast-tracking evidence = fast-tracking bad decisions. |
| "The user's MVP is clever, I can issue Closing right away" | Closing without side-effect challenge = approving a bomb you didn't inspect. Minimum 2 rounds in Stage 3. |

Static analysis

No suspicious patterns detected.