ClawHub

prd-writter

Security checks across malware telemetry and agentic risk

Overview

This is a low-risk PRD writing helper made of Markdown instructions and templates, with no executable code or hidden data access.

Safe to install as a template-based writing assistant. Avoid pasting secrets, customer personal data, or regulated production data into prompts, and review generated analytics, AI, and compliance sections before treating the PRD as implementation-ready.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger list includes very broad phrases such as “产品需求文档” and “帮我写PRD”, which can match ordinary conversation and cause unintended invocation of the skill. Accidental activation can expose user-provided business context to the skill and generate unwanted outputs, creating prompt-routing and data handling risk even if the skill itself is not overtly malicious.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill automatically designs analytics instrumentation and AI processing flows, but it does not warn users that examples or inputs may contain business-sensitive, personal, or regulated data. In practice, PRDs often include customer attributes, employee data, evaluation labels, and logging fields; omitting privacy and data-minimization guidance increases the chance that sensitive information is unnecessarily included or propagated into telemetry and AI-related sections.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal