T01 · Skill Instruction Hijacking
Note
- Location
templates/prd.md:51- Finding
Mandatory branded external-link injection into generated artifacts
- Content
View full analysis
- Remediation
View remediation
Security audit
Product Manager Skills
Security checks for vulnerabilities and agentic risk
Overview
This is a readable Markdown-based product-management assistant skill with some install and output-branding caveats, but no hidden code execution, data access, or persistence in the reviewed artifact.
Before installing, use ClawHub or a pinned trusted version if available, and review generated deliverables for the attribution footer before sharing them externally. The reviewed artifact does not require secrets, background services, or automatic script execution.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:48- Finding
Unpinned third-party package execution in installation and update instructions
- Content
View full analysis
- Remediation
View remediation
add Digidai/product-manager-skills@ ``` 2. Reference an immutable Git commit or signed release tag rather than a mutable repository head. 3. Publish and document expected package integrity hashes where the installation mechanism supports them. 4. Document the expected npm publisher, repository owner, package name, and release-signing process so users can verify provenance. 5. Prefer a lockfile-backed installation process for managed environments. 6. Advise users to review package metadata and installation changes before executing updates. 7. Avoid suggesting automatic or silent updates, and retain the existing requirement that update operations require explicit user action. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Activation phrases like
take this from idea to PRDandfull PM sprint on this featureare generic enough to overlap with ordinary product discussion. In shared agent tooling, vague routing triggers can cause the skill to seize control of a conversation unexpectedly, applying a multi-phase workflow when the user may have intended a narrower request.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrase
coach meis extremely broad and likely to appear in normal user conversation, which can unexpectedly switch the skill into a more forceful operating mode. In agent environments that compose prompts or route across skills automatically, ambiguous activation increases the chance of unintended behavior, misapplied instructions, or prompt-surface collisions with other contexts.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
The README instructs users to run
npx skills add Digidai/product-manager-skillswithout pinning a version or commit. That exposes installs to supply-chain risk: future package changes, compromised upstream dependencies, or typo/package takeover could alter what gets executed at install time. In this context the file is installation guidance, so readers are likely to copy-paste it directly, which increases practical risk.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The PM Sprint workflow is triggered by broad natural-language phrases such as '从想法到 PRD' or '帮我完整做一遍这个功能'. Because these overlap with ordinary user requests, the skill may activate a multi-stage workflow unintentionally, causing unexpected prompt routing, hidden state transitions, or overly broad task execution. In an agent skill, ambiguous triggers are security-relevant because they reduce user control over when higher-impact behavior starts.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The Coaching mode advertises broad trigger phrases like 'coach me', '教练模式', '挑战我的想法', and '严格审视这个' without strong boundary conditions. These expressions can appear in normal conversation and may switch the assistant into a stricter behavioral mode unexpectedly, altering outputs, tone, and decision rules without clear user consent. While not code execution, this is still a real control-plane weakness in a prompt-driven skill because mode confusion can lead to unintended actions or advice pathways.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The TODO describes a mechanism for acting "when AI detects PM-relevant patterns during code work," but it does not define concrete trigger conditions or clear boundaries for when the behavior should or should not activate. This is a broad natural-language activation concept that could overlap with many ordinary coding interactions and cause unintended invocations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrase "take this from idea to PRD" is broad, natural language that could plausibly appear in ordinary conversation and unintentionally activate a complex workflow. In an agent skill context, overly broad triggers can cause unintended routing, surprise behavior, or prompt-context takeover of the interaction flow, especially because this workflow chains multiple phases automatically.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file defines activation behavior with broad natural-language conditions such as 'career and leadership topics,' 'Career goal is vague,' and 'User asks for frameworks,' without clear boundaries or exclusion conditions. Those phrases overlap with common coaching or workplace conversations, making it unclear when this skill should activate versus when it should not.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The voice guidelines prohibit specific words and punctuation globally (for example, "No em dashes" and banned words) without indicating that users may opt out or choose a different style. This is a natural-language policy concern because it forces a communication style unconditionally rather than offering a user preference.
- Content
Static analysis
No suspicious patterns detected.