Project Manager

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is coherent for project task management, with disclosed local JSON edits and Reminders/chat side effects users should intend before invoking.

Before installing, verify that /Users/fz1/clawd/data/pm/projects.json is the intended task database and that Apple Reminders and chat integrations point to the right accounts. Avoid putting secrets in task fields, and only request add, move, or sync actions when you want the corresponding database changes, reminders, or chat notifications.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Adding, moving, or syncing tasks can change the local project database, create or update Apple Reminders, and send a chat notification to David.

Why it was flagged

The skill explicitly directs the agent to mutate a project task database and trigger external side effects. These actions are central to the stated project-management purpose, but users should notice that the workflow changes data and may send notifications.

Skill content
Añadir Tarea ... Insertar objeto en el array `tasks` ... Si `sync: true`, ejecutar skill `apple-reminders` ... Mover Tarea ... Actualizar `status` ... avisar a David en el chat.
Recommendation

Use add/move/sync only when those side effects are intended, and review task status changes before asking the skill to apply them.

What this means

The skill may act through the user's configured Reminders or chat accounts when syncing tasks or notifying David.

Why it was flagged

Creating reminders and sending chat messages imply use of the user's available Reminders/chat authority. The behavior is disclosed and purpose-aligned, with no artifact evidence of credential capture or misuse.

Skill content
ejecutar skill `apple-reminders` para crear recordatorio ... avisar a David en el chat
Recommendation

Confirm the connected Reminders and chat accounts are the intended ones, and keep those integrations scoped to the minimum access needed.

What this means

Project details stored in the JSON file may shape future prioritization and could include private business context.

Why it was flagged

The skill relies on persistent project data and instructs future work to use that data for prioritization. This is expected for a project manager, but persistent task content can influence later agent behavior.

Skill content
Base de datos: `/Users/fz1/clawd/data/pm/projects.json` ... Night Shift: El turno de noche debe leer este JSON para saber qué priorizar si no hay órdenes explícitas.
Recommendation

Keep the JSON limited to intended project/task information, avoid storing secrets or instructions inside task text, and review it periodically for accuracy.