跳转到正文
报告库
用途分类 / 文档处理

Product Marketing Skill 安全审计

作者说它能做什么(原文)

When the user wants to create or update their product marketing context document. Also use when the user mentions 'product context,' 'marketing context,' 'set up context,' 'positioning,' 'who is my target audience,' 'describe my product,' 'ICP,' 'ideal customer profile,' or wants to avoid repeating foundational information across marketing tasks. Use this at the start of any new project before usi

第三方安全检查结论

发现安全风险

已检查文件
2
发现的风险
1
会不会运行危险命令?检查是否下载程序后直接运行、让他人远程控制电脑,或藏起要运行的命令。未发现风险
会不会泄露文件和密钥?检查是否发送含密码或密钥的文件,以及代码里是否直接写了密钥。发现 1 项风险
中风险

广泛读取仓库后,可能把敏感商业或客户资料汇总到供其他 Skill 自动读取的文件

原文依据:5 处
发现了什么

自动起草流程要求读取 README、页面、package.json 和“任何现有文档”,没有路径范围、敏感文件排除或脱敏规则。目标文档还会收录定价、竞争对手、客户名称、指标和证言,并声明其他营销 Skill 会自动使用它。

为什么需要注意

若仓库文档包含未公开定价、客户身份、内部指标或竞争策略,这些内容可能被复制进持久上下文,并在之后的营销任务中被继续使用。现有证据没有显示网络上传,但扩大了敏感信息在代理工作流中的可见范围。

风险成立,但仅在用户选择“从代码库自动起草”时发生,且流程要求先展示草稿供审核。Skill 明确要求读取代码库中的“任何现有文档”,再把客户、指标和证言等可能敏感的商业信息写入共享上下文,并告知其他营销 Skill 会自动使用它;可见指令没有说明排除私密目录或脱敏。用户可要求作者限定允许读取的文件、默认排除客户/密钥/内部资料,并在保存及供其他 Skill 使用前逐项确认敏感内容。

SKILL.md:36来自说明文档打开原文件
**If auto-drafting:**1. Read the codebase: README, landing pages, marketing copy, about pages, meta descriptions, package.json, any existing docs2. Draft all sections based on what you find3. Present the draft and ask what needs correcting or is missing4. Iterate until the user is satisfied
查看另外 4 个位置
SKILL.md:57来自说明文档打开原文件
### 1. Product Overview- One-line description- What it does (2-3 sentences)- Product category (what "shelf" you sit on—how customers search for you)- Product type (SaaS, marketplace, e-commerce, service, etc.)- Business model and pricing
SKILL.md:117来自说明文档打开原文件
### 11. Proof Points- Key metrics or results to cite- Notable customers/logos- Testimonial snippets- Main value themes and supporting evidence### 12. Goals- Primary business goal- Key conversion action (what you want people to do)- Current metrics (if known)
SKILL.md:243来自说明文档打开原文件
  - Use today's date in ISO form (YYYY-MM-DD) for the entry and `Last updated`.  - **Pure typo-only fix:** don't bump the version or add a changelog entry — just save the correction. Every other change bumps the version and gets an entry. When the change is a real repositioning, say so plainly — downstream skills will now generate against the new context.- Save to `.agents/product-marketing.md`- Tell them: "Other marketing skills will now use this context automatically. The Changelog at the bottom tracks every revision — check it to see how your positioning has evolved. Run `/product-marketing` anytime to update it."
SKILL.md:244来自说明文档打开原文件
  - **Pure typo-only fix:** don't bump the version or add a changelog entry — just save the correction. Every other change bumps the version and gets an entry. When the change is a real repositioning, say so plainly — downstream skills will now generate against the new context.- Save to `.agents/product-marketing.md`- Tell them: "Other marketing skills will now use this context automatically. The Changelog at the bottom tracks every revision — check it to see how your positioning has evolved. Run `/product-marketing` anytime to update it."
会不会删除文件或一直在后台运行?检查是否大范围删除文件、改写磁盘,或设置自动启动。未发现风险
会不会绕过安全保护?检查是否跳过网站安全验证、开放过多文件权限,或取消操作前的确认。未发现风险
会不会误导 AI 或隐藏内容?检查工作说明是否要求 AI 忽略你的指令、干扰检查结果,或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方?检查是否强制替换推广链接或收款对象,同时要求隐瞒更改。未发现风险

Skill 逻辑拆解

5 个说明模块

该 Skill 会检查多个现有上下文文件位置;如果仅发现旧位置的文件,它会先提出迁移建议,而不是直接迁移。

查看原文
SKILL.md:16来自说明文档打开原文件
### Step 1: Check for Existing ContextFirst, check if `.agents/product-marketing.md` already exists. Also check `.claude/product-marketing.md` and the legacy filename `product-marketing-context.md` (in either `.agents/` or `.claude/`) for older setups — if found anywhere other than `.agents/product-marketing.md`, offer to move it to the canonical location.

新建上下文时,推荐流程会读取仓库中的产品和营销材料来生成草稿;另一种流程则通过逐节提问收集信息。

查看原文
SKILL.md:26来自说明文档打开原文件
**If it doesn't exist, offer two options:**1. **Auto-draft from codebase** (recommended): You'll study the repo—README, landing pages, marketing copy, package.json, etc.—and draft a V1 of the context document. The user then reviews, corrects, and fills gaps. This is faster than starting from scratch.2. **Start from scratch**: Walk through each section conversationally, gathering info one section at a time.

该文档会持久保存到 `.agents/product-marketing.md`,更新时递增版本、更新日期并保留按时间倒序排列的变更记录。

查看原文
SKILL.md:232来自说明文档打开原文件
## Step 4: Confirm, Version, and Save- Show the completed document- Ask if anything needs adjustment- **Set the version and changelog** — this is the paper trail for a doc every other skill reads:  - **New document:** set `Document version: v1` and a single Changelog entry — `- v1 ([today]) — Initial context.`  - **Updating an existing document:** increment the version (v2 → v3 …), update `Last updated` to today, and **prepend a new Changelog entry** at the top of the list (newest first) summarizing *what changed and why* in one line. Never rewrite or reorder past entries.  - A good entry names the sections touched and the reason, not "updated the doc." Examples:    - `- v3 (2026-07-16) — Repositioned from "email tool" to "deliverability platform"; added RevOps to the ICP.`    - `- v2 (2026-06-02) — Rewrote value prop and objections after 5 customer interviews; added competitor Acme.`  - Use today's date in ISO form (YYYY-MM-DD) for the entry and `Last updated`.  - **Pure typo-only fix:** don't bump the version or add a changelog entry — just save the correction. Every other change bumps the version and gets an entry. When the change is a real repositioning, say so plainly — downstream skills will now generate against the new context.- Save to `.agents/product-marketing.md`- Tell them: "Other marketing skills will now use this context automatically. The Changelog at the bottom tracks every revision — check it to see how your positioning has evolved. Run `/product-marketing` anytime to update it."

流程要求先展示草稿并征求纠正意见;测试期望也明确要求在保存前供用户审阅。

查看原文
SKILL.md:36来自说明文档打开原文件
**If auto-drafting:**1. Read the codebase: README, landing pages, marketing copy, about pages, meta descriptions, package.json, any existing docs2. Draft all sections based on what you find3. Present the draft and ask what needs correcting or is missing4. Iterate until the user is satisfied
evals/evals.json:48来自说明文档打开原文件
      "id": 4,      "prompt": "Can you auto-draft our product marketing context from our existing codebase and marketing materials?",      "expected_output": "Should activate the auto-draft workflow mode. Should scan the codebase for existing marketing context: README, landing page copy, pricing page, about page, meta descriptions, any existing documentation. Should draft the product-marketing.md from what it finds, filling in sections where information is available and flagging sections that need manual input. Should present the draft for review before saving.",      "assertions": [        "Activates auto-draft workflow mode",        "Scans codebase for existing marketing materials",        "Drafts context from found information",        "Flags sections needing manual input",        "Presents draft for review before saving"      ],
从这里开始 · 工作说明SKILL.md
product-marketing
连线表示工作说明包含的模块,不是实际运行顺序。点击模块可查看原文。
文件与检查记录2 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围;纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • evals/evals.json已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件,没有实际运行 Skill,也没有检查它另外安装的软件包。因此,这不是“保证安全”的承诺;换了版本或使用环境,结果也可能不同。

  • SKILL.md工作说明
  • evals/evals.json配套文件
读取了多少行
355
文件校验值(用于核对版本)
174cce97c281530e7bb822d8fb831e28fc4ec62d2547efa7411446af3ba06a75