product-analysis

• Outcome: Pass
• Latest audit: Sep 28, 2026 · 5:26 AM UTC
• Version: 1.1.0

Overview

This skill is a disclosed product-requirements workflow that reads uploaded requirements, generates local deliverable files, and runs local quality checks without hidden exfiltration or destructive behavior.

Install only if you are comfortable with a Chinese-language product-analysis workflow that reads uploaded requirement documents, creates local output files under /mnt/user-data/outputs, and may run web searches when you ask for research. Review generated analytics and tracking sections for your own privacy, consent, retention, and regional compliance requirements before using them as implementation specs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (62)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a comprehensive product-requirements-analysis skill with multiple workflow modes and rich document-generation outputs. The supplied code, however, is only a single command-line utility for checking MECE properties in a markdown document. It extracts feature lists and requirement text, computes feature overlap via token similarity, checks requirement keyword coverage, prints findings, and returns an exit code. This is related to requirements documentation quality, but it is materially narrower than the declared purpose and lacks the advertised generation capabilities and workflow orchestration. Therefore, the description does not accurately represent the actual code behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description presents a full product-requirements-analysis skill that analyzes needs and produces multiple kinds of deliverables across quick/standard/iterative workflows. The supplied code does not do analysis or generation; it only checks an already-written Markdown document for structural/content quality. While the checked document types align with product-analysis artifacts (flow, architecture, PRD, tracking), that is only tangential support. The primary purpose and capabilities are materially different, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的是一个面向产品需求分析的高层业务 skill，核心能力应包括需求理解、流程/架构分析、文档生成和迭代差异分析。实际代码却仅实现了一个本地文件级的 Mermaid 语法验证工具，没有任何需求分析、业务建模、文档生成或迭代比较逻辑。虽然声明中提到会输出 Mermaid 流程图，当前代码与 Mermaid 有一定关联，但它只是在校验 Mermaid 代码块，属于非常狭窄且辅助性的功能，无法代表所声明的主要用途。因此这是明显的描述与行为不一致。

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · guides/fast-workflow.md (reported line 79)May include surrounding context.

else echo "SKIP: 脚本目录未找到，跳过自动化检查，改为人工核查 Mermaid 语法" fi rm /tmp/qa_check_temp.md

text

**分步确认模式下**（MUST）：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · guides/fast-workflow.md (reported line 117)May include surrounding context.

else echo "SKIP: 脚本目录未找到，跳过自动化检查，改为人工核查 Mermaid 语法" fi rm /tmp/qa_check_temp.md

text

**分步确认模式下**（MUST）：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · guides/iteration-workflow.md (reported line 121)May include surrounding context.

else echo "SKIP: 脚本目录未找到，跳过自动化检查，改为人工核查 Mermaid 语法" fi rm /tmp/qa_check_temp.md

text

**分步确认模式下**（MUST）：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · guides/iteration-workflow.md (reported line 185)May include surrounding context.

else echo "SKIP: 脚本目录未找到，跳过自动化检查，改为人工核查 Mermaid 语法" fi rm /tmp/qa_check_temp.md

text

**分步确认模式下**（MUST）：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · guides/standard-workflow.md (reported line 108)May include surrounding context.

else echo "SKIP: 脚本目录未找到，跳过自动化检查，改为人工核查 Mermaid 语法" fi rm /tmp/qa_check_temp.md

text

**分步确认模式下**（MUST）：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · guides/standard-workflow.md (reported line 165)May include surrounding context.

else echo "SKIP: 脚本目录未找到，跳过自动化检查，改为人工核查 Mermaid 语法" fi rm /tmp/qa_check_temp.md

text

**分步确认模式下**（MUST）：

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/drawio-standards.md (reported line 66)May include surrounding context.

md

<mxCell id="0"/>
        <mxCell id="1" parent="0"/>

        <!-- 开始节点（椭圆） -->
        <mxCell id="2" value="开始" style="ellipse;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;"
                vertex="1" parent="1">
          <mxGeometry x="80" y="40" width="120" height="60" as="geometry"/>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/drawio-standards.md (reported line 66)May include surrounding context.

md

<mxCell id="0"/>
        <mxCell id="1" parent="0"/>

        <!-- 开始节点(椭圆) -->
        <mxCell id="2" value="开始" style="ellipse;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;"
                vertex="1" parent="1">
          <mxGeometry x="80" y="40" width="120" height="60" as="geometry"/>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/drawio-standards.md (reported line 103)May include surrounding context.

md

<mxGeometry relative="1" as="geometry"/>
        </mxCell>

        <!-- 连接线（虚线，异常路径） -->
        <mxCell id="9" value="否" style="edgeStyle=orthogonalEdgeStyle;dashed=1;strokeColor=#FF0000;"
                edge="1" source="4" target="3" parent="1">
          <mxGeometry relative="1" as="geometry"/>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/drawio-standards.md (reported line 103)May include surrounding context.

md

<mxGeometry relative="1" as="geometry"/>
        </mxCell>

        <!-- 连接线(虚线,异常路径) -->
        <mxCell id="9" value="否" style="edgeStyle=orthogonalEdgeStyle;dashed=1;strokeColor=#FF0000;"
                edge="1" source="4" target="3" parent="1">
          <mxGeometry relative="1" as="geometry"/>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/drawio-standards.md (reported line 135)May include surrounding context.

md

<mxCell id="0"/>
        <mxCell id="1" parent="0"/>

        <!-- 初始状态（实心圆） -->
        <mxCell id="2" value="" style="ellipse;fillColor=#000000;strokeColor=#000000;"
                vertex="1" parent="1">
          <mxGeometry x="120" y="40" width="40" height="40" as="geometry"/>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/drawio-standards.md (reported line 135)May include surrounding context.

md

<mxCell id="0"/>
        <mxCell id="1" parent="0"/>

        <!-- 初始状态(实心圆) -->
        <mxCell id="2" value="" style="ellipse;fillColor=#000000;strokeColor=#000000;"
                vertex="1" parent="1">
          <mxGeometry x="120" y="40" width="40" height="40" as="geometry"/>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/drawio-standards.md (reported line 201)May include surrounding context.

md

<mxGeometry x="40" y="40" width="800" height="450" as="geometry"/>
        </mxCell>

        <!-- 泳道1：用户 -->
        <mxCell id="3" value="用户" style="swimlane;startSize=30;horizontal=0;"
                vertex="1" parent="2">
          <mxGeometry x="0" y="20" width="800" height="140" as="geometry"/>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/drawio-standards.md (reported line 201)May include surrounding context.

md

<mxGeometry x="40" y="40" width="800" height="450" as="geometry"/>
        </mxCell>

        <!-- 泳道1:用户 -->
        <mxCell id="3" value="用户" style="swimlane;startSize=30;horizontal=0;"
                vertex="1" parent="2">
          <mxGeometry x="0" y="20" width="800" height="140" as="geometry"/>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/drawio-standards.md (reported line 282)May include surrounding context.

md

<mxCell id="0"/>
        <mxCell id="1" parent="0"/>

        <!-- 参与者（顶部矩形框） -->
        <mxCell id="2" value="用户" style="shape=mxgraph.flowchart.actor;whiteSpace=wrap;html=1;"
                vertex="1" parent="1">
          <mxGeometry x="80" y="40" width="80" height="80" as="geometry"/>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/drawio-standards.md (reported line 282)May include surrounding context.

md

<mxCell id="0"/>
        <mxCell id="1" parent="0"/>

        <!-- 参与者(顶部矩形框) -->
        <mxCell id="2" value="用户" style="shape=mxgraph.flowchart.actor;whiteSpace=wrap;html=1;"
                vertex="1" parent="1">
          <mxGeometry x="80" y="40" width="80" height="80" as="geometry"/>

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill invokes file-reading behavior (view /mnt/user-data/uploads/<文件名>) but does not declare an explicit tool scope such as allowed tools or permissions. Missing scope boundaries increases the chance of unintended file access or overbroad execution in environments that rely on manifest constraints for enforcement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Overly broad trigger phrases can cause the skill to activate on unrelated conversations or ordinary uploaded documents, leading to unintended file reads and workflow execution. In a system where activation grants tool use, ambiguous routing increases the risk surface and may process sensitive content without clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

文件整体以中文规定触发词、流程说明和用户确认话术，但未说明可根据用户偏好切换语言，也未提供语言选择机制。按规则，强制单一语言而没有用户选择或明确合理的区域限定，属于自然语言层面的语言/locale policy 问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The entire template is written in Chinese and provides no indication that another language can be used or that Chinese is optional. Per the policy, a skill artifact that implicitly requires a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template contains detailed telemetry and analytics plans that explicitly collect identifiers and behavioral data such as user_id, login method, search terms, order data, device attributes, and monitoring events, but it does not require any privacy notice, consent basis, retention limit, minimization rule, or regional compliance check. In a reusable PRD template, this omission can normalize over-collection and lead downstream teams to implement tracking that violates privacy requirements or internal policy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The template explicitly includes user_id as a standard tracking parameter and public user attribute, but it provides no guidance on minimization, lawful basis, consent, retention, masking, or restrictions on using direct identifiers. In a product-analysis skill that helps generate analytics and PRD artifacts, this omission can propagate privacy-unsafe instrumentation into downstream implementations across multiple teams.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.