Security audit

PRD & Interactive Prototype

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent, but its generated HTML is active script-bearing content with an unsafe rendering pattern and it inaccurately describes that output as script-free.

Review or edit generated HTML before opening from untrusted requirements or publishing it. Remove the default QQ author chip if it should not appear in your deliverable, and treat generated pages as executable HTML, not inert documents. Use pinned dependencies or an isolated environment for optional Playwright verification.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: assets/prd-template.html:149
Finding: Persistent Promotional Content Injected into Generated PRD Deliverables
Content: View full analysis

QQ 965621229原型工具作者
v1.4 ``` The skill documentation also explicitly promotes this contact: ```markdown > **作者 / Author：** QQ 965621229 · **License：** MIT · 反馈、合作或问题请加 QQ ``` ### Technical Analysis The skill workflow instructs the agent to use `assets/prd-template.html` as the basis for generated PRDs. The template embeds the skill author's QQ identifier and promotional attribution directly in the visible header. This content is unrelated to the user's product requirements and is therefore propagated into user-owned deliverables without a functional need. Because the skill also supports public deployment, the injected attribution can become visible to every recipient of a generated or published PRD. The behavior persistently influences the agent's output rather than merely documenting package authorship in metadata or a license file. The same hardcoded block is present in `references/example-full.html`, reinforcing the expectation that generated documents retain the promotion. ### Attack Path 1. The user ...[truncated 1134 chars]
Remediation: View remediation
``` 3. Do not copy package author information into generated deliverables by default. 4. Keep package attribution only in `LICENSE.txt`, package metadata, or documentation that is not incorporated into user output. 5. Update `SKILL.md` so that the workflow explicitly requires removing template-specific branding before delivery. 6. Add an automated test that scans generated artifacts for undeclared contact identifiers and fails if package-author promotion appears without explicit user consent. 7. If attribution is required for licensing reasons, clearly document that requirement and obtain explicit user consent before including it in externally distributed artifacts. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: assets/prd-template.html:344
Finding: DOM-Based Cross-Site Scripting Through Unsafe Interaction Metadata Rendering
Content: View full analysis
{ const d=document.createElement('div'); d.className='ix-item'; d.innerHTML=''+(el.dataset.ixTitle||('交互 '+(i+1)))+''+el.dataset.ix+''; d.addEventListener('click',()=>{ el.scrollIntoView({behavior:'smooth',block:'center'}); const prev=el.style.outline;el.style.outline='2px solid var(--accent)'; setTimeout(()=>{el.style.outline=prev;},1200); }); list.appendChild(d); }); } })(); ``` ### Technical Analysis The interaction panel reads `data-ix-title` and `data-ix` values from document elements and concatenates them directly into `d.innerHTML`. No HTML encoding or sanitization is performed before browser parsing. Although the bundled template contains static values, the skill is expressly designed to generate and replace these descriptions using user-provided product requirements. Consequently, attacker-controlled or untrusted requirement text may reach these attributes. When the page initializes, the browser reparses the values as active HTML. For example, if a generated artifact contains an interaction value equivalent to: ```html data-ix="<img src=x onerror=alert(document.domain)>" ``` the DOM API exposes the decoded attribute value to JavaScript. Assigning that value to `innerHTML` creates an actual `` element, and its error handler can execute. The separate `svg.innerHTML=''` assignment at line 315 only clears a known S ...[truncated 1674 chars]
Remediation: View remediation
{ const item = document.createElement('div'); item.className = 'ix-item'; const title = document.createElement('b'); title.textContent = el.dataset.ixTitle || `Interaction ${i + 1}`; const description = document.createElement('span'); description.textContent = el.dataset.ix || ''; item.append(title, description); item.addEventListener('click', () => { el.scrollIntoView({ behavior: 'smooth', block: 'center' }); const previousOutline = el.style.outline; el.style.outline = '2px solid var(--accent)'; setTimeout(() => { el.style.outline = previousOutline; }, 1200); }); list.appendChild(item); }); ``` Additional hardening should include: 1. Safely encode all generated HTML attribute values, including quotation marks and angle brackets. 2. Treat every user-supplied PRD field as untrusted data. 3. Avoid `innerHTML`, `outerHTML`, `insertAdjacentHTML`, and similar parsing sinks for generated content. 4. If rich formatting is required, sanitize it with a pinned, audited allowlist sanitizer before insertion. 5. Add tests using payloads in `data-ix` and `data-ix-title`, including event handlers, SVG payloads, malformed tags, and encoded markup. 6. Deploy hosted artifacts with a restrictive Content Security Policy that blocks inline script and event-handler execution. Because the current template uses inline JavaScript, move it to a separately hashed resource or use CSP hashes/nonces as part of this hardening. 7. Apply the same fix to both the template and the complete example to prevent vulnerable code from being copied back into future output. ]]>

T08 · Insecure Dependencies

Warning

Location: references/ONBOARDING.md:17
Finding: Unpinned Playwright and Browser Binary Installation in Optional Verification Workflow
Content: View full analysis
Remediation: View remediation
``` or: ```bash python -m pip install --require-hashes -r requirements.txt ``` 2. Commit and enforce the appropriate lockfile: - `package-lock.json`, `pnpm-lock.yaml`, or `yarn.lock` for Node.js. - A hash-locked requirements file for Python. 3. Use clean, reproducible installation commands such as `npm ci` instead of mutable dependency resolution. 4. Restrict installations to the expected official package registry and document the trusted source. 5. Verify package signatures or checksums where supported. 6. Run browser verification in an isolated container or sandbox with: - No production credentials. - Minimal filesystem access. - Restricted outbound networking. - A disposable dependency cache. 7. Require explicit user confirmation before installing packages or downloading browser binaries. 8. Document the expected Playwright and Chromium versions and update them through a reviewed dependency-upgrade process. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · assets/prd-template.html (reported line 7)May include surrounding context.
html
<meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>团队订餐拼单 · 产品原型与需求说明</title>  <style> :root{ --bg:#f5f6f8; --surface:#fff; --surface-2:#fcfcfd;

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/example-full.html (reported line 7)May include surrounding context.
html
<meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>团队订餐拼单 · 产品原型与需求说明</title>  <style> :root{ --bg:#f5f6f8; --surface:#fff; --surface-2:#fcfcfd;

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The documentation states this is a 'pure prompt + references + assets, no executable scripts' package, which suggests a narrowly non-executing artifact. However, elsewhere in the same README the skill is described as opening generated files locally and optionally publishing them online, which are meaningful operational side effects beyond merely being static content. This is an intent/documentation mismatch within the skill documentation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill advertises the generated artifact as having 'no executable script' while elsewhere explicitly depending on JavaScript for tabs, state updates, rendering, line drawing, and interaction panels. This mismatch is dangerous because it can mislead users or reviewers into applying a lower trust threshold to active content, increasing the chance that script-bearing HTML is opened, shared, or published without appropriate scrutiny.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: L05 明确规定除英文专有名词外，所有说明统一使用中文。这属于语言/locale 层面的硬性要求，但文档中未说明需经用户选择，也未给出仅面向中文用户或特定地区场景的限制理由。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTML root sets lang="zh-CN", and the page content and UI labels are written exclusively in Simplified Chinese. This indicates a fixed language/locale experience without any visible opt-in, selection mechanism, or documented region-specific justification, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Line L005 states that the main narrative should be uniformly written in Chinese. This is a natural-language locale restriction and does not offer the user an explicit language choice or justify the constraint as region-specific compliance, so it conflicts with the language/locale policy requirement.
Content: No source excerpt is available for this finding.

Ssd 3

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The changelog explicitly republishes a personal contact identifier ("QQ 965621229") and frames the artifact as safe to share, which normalizes further redistribution of personal data. Even if the identifier is intended as author contact information, embedding it in a broadly shared skill package creates unnecessary privacy exposure, enables scraping or unsolicited contact, and the "safe sharing" language is misleading from a data-minimization perspective.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document declares lang="zh-CN", and the visible UI text throughout the template is fixed in Simplified Chinese. For SQP-3, this is a natural-language locale policy concern because the file enforces a specific language/locale without indicating user opt-in or that the template is intentionally region-specific.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The prototype text and data-ix annotations describe actions such as "拉起相机识别会员二维码" and "调用支付接口", which imply real device or backend integration. However, the handlers at L291-L300 only set a hardcoded amount, switch views, and change button text locally, so the inline intent documentation contradicts the actual behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file presents all operational instructions in Chinese, which can amount to a language-policy issue when no user opt-in or alternative locale is provided. The rules specifically call for flagging cases where a skill forces a specific language without giving the user a choice.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The page copy says '模拟开单' creates a group order and generates a share link, and the interaction note says it creates an order then jumps to the selection page. The click handler does not create any order object or link; it merely sets mpAmount=38 and navigates to the next mock screen, which is a direct divergence between the documentation text and actual code behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The UI text and data-ix annotation state that clicking the payment button will '调用支付接口' and transition payment state, implying an actual payment API call. In code, the handler only changes button text and color locally with no network request or payment integration, so the inline interaction documentation contradicts the implemented behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file presents the methodology guidance primarily in Chinese, with only partial English glosses, and does not state that the user can choose another language. That can violate a language/locale policy when a skill implicitly forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.