Security audit

Prd Assistant Tob Saas

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Chinese-language PRD assistant skill with no hidden code execution, persistence, credential access, or exfiltration behavior found.

Install only if you want a Chinese-language ToB SaaS PRD workflow. Before using PRD review or competitor screenshot analysis, provide only authorized materials, redact secrets, customer data, credentials, and internal-only strategy, and keep batch screenshot jobs scoped to explicit file lists and outputs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The description claims a full-featured ToB SaaS PRD assistant with multiple product-planning and document-review capabilities. However, the provided code chunk does not implement any of these functions. It only prints a simple example message and includes comments indicating that actual logic is still TODO. This is a clear description-to-behavior mismatch because the code’s actual behavior does not substantively represent the declared skill purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill explicitly encourages uploading and analyzing competitor screenshots but provides no warning that screenshots may contain personal data, credentials, internal dashboards, customer records, or other confidential business information. Because the skill is designed for bulk processing and structured extraction, it increases the chance that sensitive content will be ingested, retained, or redistributed without user awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The PRD review flow tells users to provide PRD documents and supporting materials, which commonly contain confidential roadmap details, customer needs, pricing, architecture, and partner information, but gives no caution about handling sensitive data. This omission creates a realistic risk of inadvertent disclosure of proprietary business information during review or summarization workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The industrialized pipeline recommends large-scale, parallel processing of many screenshots and generation of structured comparison outputs, but does not warn about the amplified privacy and confidentiality risk from batch ingestion. At this scale, sensitive data can be systematically extracted and propagated into derived artifacts, increasing exposure beyond a single-file upload.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The title and introductory description are entirely in Chinese, and the document provides no option for alternative languages or any note that the skill is region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: 该表将“健康/医疗/患者”“跨境/海外/全球”“金融/银行/保险”等常见业务词直接作为自动触发合规检查的条件，但未限定上下文、组合条件或排除示例。这种描述对于markdown文件属于触发范围定义过宽，容易在普通PRD描述中产生大量非预期触发。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The title and introductory description present the skill as a PRD assistant entirely in Chinese, with no indication that users may choose another language or that the Chinese-only constraint is required for a specific regional/compliance context. This creates a natural-language locale policy concern because the skill appears to impose a fixed language by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The title and introductory description present the skill content entirely in Chinese, with no indication that language is optional or that users may request another locale. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill description is written only in Chinese, including the title and operational descriptions, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. This creates a natural-language locale policy concern because it effectively imposes a language constraint without opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown template is entirely written in Chinese and presents the PRD structure as the default without any note that another language may be used. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.