ClawHub
Back to skill

Security audit

PRD Iterative

Security checks across malware telemetry and agentic risk

Overview

This skill runs a disclosed PRD-writing workflow that may fetch user-provided links and write Markdown files after confirming details with the user.

Before installing, be aware that this skill is meant for a structured multi-round workflow, not quick one-off PRD advice. Confirm the models, number of rounds, and output folder, and only provide links or background material you are comfortable having the selected models process.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger phrases are broad enough to match common, ordinary requests for PRD help, which can cause the skill to activate outside its intended scope. In an agent system, over-broad activation can route users into a workflow that invokes model selection, link fetching, and file-path handling without clear need, increasing the chance of unintended actions or prompt-scope confusion.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The applicable-scenario section lists examples like general PRD-writing requests but does not define when the skill should not activate, leaving activation boundaries ambiguous. This makes accidental invocation more likely, especially for routine product-writing assistance, which can expose users to unnecessary multi-agent orchestration and downstream actions such as content fetching or writing to user-specified paths.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal