Dev Project Manager

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:10 AM UTC
• Version: 1.0.3

Overview

This is a disclosed project-management workflow skill that can update project records and Asana through dependency skills, so users should install it only for agents meant to manage those projects.

Install this only on a PM agent that should manage the named OpenClaw projects. Before use, verify USER.md, HEARTBEAT.md, AGENTS.md, and dependency skills point to the intended projects and agents, because the skill can create/archive Asana tasks, update persistent project state, and nudge other agents when triggered.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger conditions are extremely broad and can cause the PM skill to activate on ordinary conversation about software work, status, estimates, or requirements. In an agentic environment, over-triggering can lead to unintended file reads/writes, queue manipulation, and outbound nudges to other agents, increasing the risk of unsafe autonomous actions from irrelevant prompts.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The credential/scheduling section says that on heartbeat failure the skill must stop immediately, not retry, and only log if available. Later heartbeat and monitoring sections instruct the PM to post to queue files, send sessions_send nudges, and update project-lock.json for blocked or stuck tasks, which are side effects beyond simply logging and stopping when failures occur during the queue check.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The role definition explicitly states the PM should not interact directly with dev/QA agents and that the engineer handles technical planning and agent coordination. Later sections instruct the PM to assign tasks directly to dev agents, post to their queue files, and send sessions_send nudges to dev-fe, dev-be, qa, and n8n_engineer, which directly contradicts that earlier intent statement.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Project Folder

Every project you manage has a folder at `~/.openclaw/projects/[project_name]/`. You are the primary owner of phase transitions in this folder — you write to `project-lock.json`, `DECISIONS.md`, `STATE.md`, `SPEC-CURRENT.md`, and the queue files more than any other agent.

### Folder Structure

• Confidence: 93% confidence
• Finding: The skill is instructed to persist and update multiple authoritative workspace files, including phase state, decisions, specs, and queue files. In the presence of prompt injection, ambiguous triggers, or misrouting, this creates a durable integrity risk: a malicious or accidental invocation can alter project state, fabricate audit history, or enqueue work for other agents, with effects that persist across sessions.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The manifest says the skill does not make Asana API calls directly and relies on a separately installed Asana skill, but the sprint-close fallback says to log completion in the Asana project description if the Email skill is unavailable. This is contradictory documentation because that fallback still implies a write to Asana despite the surrounding text framing this skill as workflow-only with no direct external calls.

Static analysis

No suspicious patterns detected.