pm-feature
Warn
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The preamble in SKILL.md executes a local script named check-update.sh. As the content of this script is not provided in the skill package for review, its actions cannot be verified, posing a potential risk of unauthorized system modifications or network activity.
- [PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection by ingesting untrusted functional requirements and design documents.
- Ingestion points: The skill reads PRD and Prototype documents from docs/02-方案设计/ during Step 3.
- Boundary markers: The instructions fail to provide delimiters or specific warnings to the agent to disregard potential instructions embedded within the source files.
- Capability inventory: The skill is granted access to Bash, Write, and Agent tools, which could be exploited to perform file operations or command execution if a malicious instruction is processed.
- Sanitization: There is no validation or sanitization of the content from the ingested documents before it is used to define development tasks and system logic.
Audit Metadata