Security audit

Ai Pm Workbench 1.1.0

Security checks across malware telemetry and agentic risk

Overview

This skill is a large AI product management reference/workbench, and its sensitive-looking content is mostly design guidance rather than hidden runtime behavior.

Reasonable to install if you want a broad Chinese-language AI product management reference skill. Expect it to activate for many AI PM-related requests and to add author/legal disclaimer text unless your agent/router constrains that behavior. When reusing the customer-service or agent examples, apply explicit user notice, data minimization, redaction, retention limits, and human approval for refunds, account changes, messaging, or other state-changing actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill metadata includes a very broad trigger list covering common professional terms such as 'AI PM', 'Prompt工程', '模型选型', and 'AI安全'. In an agentic skill-routing system, overly generic triggers can cause unintended activation, making the skill intercept unrelated requests and override more appropriate skills or default behavior.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The instruction '开始使用：直接告诉我你要做什么，Skill自动匹配阶段、方法论、工具链' encourages activation from unconstrained free-form user input. This weak boundary allows the skill to self-select for a wide range of ambiguous requests, increasing the chance of accidental routing and prompt-context interference.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The repeated start-use instruction reinforces broad automatic matching behavior and normalizes the idea that the skill should infer applicability from almost any request. Repetition increases the likelihood that downstream orchestration or prompt-selection logic treats this skill as globally relevant, which can crowd out safer or more specialized skills.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The example explicitly assembles user profile data, recent tickets, dialogue history, and API-returned order/member information into the LLM context, but does not pair that design with a clear user-facing notice, consent model, or minimization guidance at the point of use. In a customer-service setting this increases the risk of over-collection, secondary use of personal data, and accidental disclosure through prompts, logs, or model outputs, especially because the same document encourages broad context packing for better answers.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/templates/prompt-engineering-template.md:380