ClawHub
Back to skill

Security audit

PM Agent

Security checks for vulnerabilities and agentic risk

Overview

This is a readable Markdown-only product-management skill, with minor cautions about an unpinned npx install example and a built-in attribution link in generated templates.

Installing through ClawHub appears appropriate for a Markdown-only PM guidance skill. Before using generated PRDs, roadmaps, or similar artifacts externally, check whether you want to keep or remove the attribution footer. If installing outside ClawHub, prefer a pinned or reviewed installer/source revision instead of the unpinned npx example.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:68
Finding

Mandatory Promotional Backlink Injection in Generated Deliverables

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:68-73, SKILL.md:170; all files under templates/ at their attribution footer lines
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

SKILL.md:68-73:

markdown
2. **Load knowledge:** Read the knowledge module file listed in the "Load" column. In pre-loaded environments (e.g., Claude Projects), the content is already in context — search by section name. The `knowledge/` and `templates/` directories are siblings of this SKILL.md file.
3. **Focus:** Within the loaded module, find the section closest to the Framework column name. If the route maps to multiple sections (e.g., "A + B"), read both. Apply that section's framework, decision logic, and domain-specific quality gates.
4. **Interact:** Use the Interaction Protocol above — direct output for simple requests, guided/dump/guess for complex ones.
5. **Template:** If producing a deliverable artifact (PRD, user story, positioning statement, etc.), also load the matching template from the Template Index. If no template exists for the artifact type, structure the output using the framework in the knowledge module.
6. **Quality check:** Apply the Universal Quality Gates (bottom of this file) to every output. The loaded knowledge module also has domain-specific quality gates — apply those too.
7. **Close:** End with decisions made, assumptions to validate, and recommended next step.

SKILL.md:170:

markdown
When producing a deliverable artifact, load the matching template and fill it with the user's specific content. Templates are pure scaffolding — not generic placeholders.

Each of the twelve deliverable templates contains this fixed footer:

markdown
*Generated with [product-manager-skills](https://github.com/Digidai/product-manager-skills)*

Affected footer locations:

  • templates/business-health-scorecard.md:45
  • `templates/competitive ...[truncated 2198 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the Generated with product-manager-skills footer from all twelve templates.
  2. Keep attribution and repository metadata in README.md rather than in user-facing artifact templates.
  3. If attribution is desired, make it explicitly opt-in and request user consent before adding it.
  4. Add an instruction stating that template metadata, branding, promotional text, and unrelated links must not be copied into final deliverables unless the user requests them.
  5. Add regression tests or review checks confirming that generated artifacts do not contain unsolicited links or attribution.
  6. Separate internal template comments from rendered template content so implementation guidance cannot accidentally enter final output.

T08 · Insecure Dependencies

Warning
Location
README.md:42
Finding

Unpinned Third-Party Package Execution in Documented Installation Flow

Content
View full analysis

Vulnerability Details

File Location: README.md:42-45, README.md:172, README.zh-CN.md:24-27
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

README.md:42-45:

markdown
### Codex / Cursor / Windsurf / GitHub-based skill loaders

```bash
npx skills add Digidai/product-manager-skills
text

The same installation method is repeated at `README.md:172`:

```markdown
| Codex / Cursor / Windsurf | `npx skills add Digidai/product-manager-skills` |

README.zh-CN.md:24-27 also documents:

bash
npx skills add Digidai/product-manager-skills

Technical Analysis

The documented command asks npx to resolve and execute the package named skills without pinning a reviewed package version or integrity digest. The executed installer is external to this repository and can change independently after this Skill has been audited.

The repository reference supplied to that installer is also not pinned to an immutable commit hash. Consequently, both the installer and installed Skill revision may differ from the versions originally reviewed.

No evidence in the audited repository establishes that the current external package is malicious. The vulnerability is the mutable and unaudited supply-chain execution path.

Attack Path

  1. A user follows the documented npx skills add installation command.
  2. npx resolves the currently available version of the external skills package.
  3. npm downloads and executes package-controlled installer code with the user's local privileges.
  4. The installer retrieves the current state of Digidai/product-manager-skills rather than an explicitly audited commit.
  5. If the npm package, maintainer account, dependency chain, release process, or repository is compromised, attacker-controlled code or Skill content can be delivered during installation.

Impact Assessment

Impact is conditional on compromise ...[truncated 810 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the npm installer to a specifically reviewed version, for example npx skills@<reviewed-version>, rather than resolving the latest release.
  2. Pin the Skill source to an immutable Git commit or signed release tag.
  3. Publish and document cryptographic checksums for reviewed release artifacts.
  4. Use npm lockfiles and integrity metadata wherever the installation mechanism supports them.
  5. Document the installer package owner, expected package scope, verified source repository, and verification procedure to reduce dependency-confusion and typosquatting risk.
  6. Prefer an installation mode that downloads human-readable files without automatically executing third-party package code.
  7. Keep the pinned versions synchronized across README.md, README.zh-CN.md, and other installation documentation.
  8. Periodically re-audit the installer and its transitive dependencies before updating the pinned version.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The README instructs users to run npx skills add Digidai/product-manager-skills without pinning an exact package version. Because npx resolves and executes code from the npm ecosystem at install time, users may receive a newer or compromised package than expected, creating a supply-chain execution risk even though this repository itself is Markdown-only.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

This is a second occurrence of the same unsafe install pattern: npx skills add Digidai/product-manager-skills is presented without an exact package version. Even in a non-executable Markdown repo, the danger comes from the installer invocation itself, which can fetch and run unpinned npm code or changed upstream content.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The README instructs users to run npx skills add Digidai/product-manager-skills without pinning an exact package version. This can cause users to execute whatever version is currently resolved at install time, increasing supply-chain risk if the package or one of its dependencies is later compromised or changed in an unsafe way. The fact that this is only documentation reduces immediacy, but it still directly guides code execution on a user's machine.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

该文件标题直接表明为“中文说明”，且全文仅提供中文内容，没有说明这是可选语言版本、也没有在文内给出语言选择或适用范围。根据规则，强制特定语言而无用户选择可能构成语言/locale 政策问题。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.