ClawHub
Back to skill

Security audit

Product Manager Skills

Security checks across malware telemetry and agentic risk

Overview

This is a product-management coaching and template skill whose sensitive behavior is limited to disclosed in-session reuse of product context.

Install if you want a direct PM-style assistant that may challenge weak framing and reuse business context during the same conversation. Avoid providing confidential metrics or strategy details unless you are comfortable with them being referenced later in that session, and treat update helpers as manual actions only.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The skill states that it remembers product stage, team structure, metrics baseline, and framework preferences within a session, but it does not clearly warn users that provided business context will be retained and reused. In a PM skill, this context can include sensitive commercial or organizational information, so silent retention increases the risk of unintended disclosure or over-sharing across turns.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The coaching-mode trigger is defined in natural-language terms without a precise activation boundary, which can cause the agent to enter a more forceful interaction style in situations the user did not intend. In an agent skill, ambiguous behavioral triggers are a security concern because they can be exploited by prompt content or incidental phrasing to override expected behavior, produce persistent pushback, or bypass safer/default interaction norms.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.