oh-my-ai/discovery-interview
Interactive discovery interview → structured product spec. Triggers: spec, PRD, requirements, scoping, brainstorming, new project. Uses AskUserQuestion; WebSearch/WebFetch when user wants research. Outputs user stories, acceptance criteria, constraints.
99
100%
Does it follow best practices?
Impact
96%
2.28xAverage score across 3 eval scenarios
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The skill explicitly requires running research loops using WebSearch/WebFetch (see SKILL.md: "WebSearch/WebFetch when the user wants research" and the mandated "At least one research loop" with example WebSearch + WebFetch), which fetches and interprets open/public web content that can directly influence decisions and the generated spec.
- Audited
- Security analysis