Security audit

Prd Workflow

Security checks for vulnerabilities and agentic risk

Overview

The PRD workflow mostly matches its stated purpose, but it bundles under-disclosed high-risk behavior including hard-coded admin credentials, unsafe shell execution paths, and automatic global dependency installation.

Install only after reviewing and removing the bundled private-platform analyzer and hard-coded credentials, pinning or disabling postinstall dependency installation, and fixing shell command construction. Treat PRDs and local wiki content as potentially sensitive because parts of the workflow can pass document excerpts to AI/external-compatible endpoints despite the local-only claim.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: workflows/modules/export_module.js:201
Finding: Shell Command Injection Through an Untrusted PRD Title
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: skills/htmlPrototype/main.py:467
Finding: Shell Command Injection Through the Prototype Output Path
Content: View full analysis
tuple: """获取输出路径""" if custom_output: output_dir = Path(custom_output).parent base_name = Path(custom_output).stem else: # 默认输出到桌面 output_dir = Path.home() / "Desktop" base_name = f"prototype_{page_type}" html_path = output_dir / f"{base_name}.html" png_path = output_dir / f"{base_name}.png" return html_path, png_path ``` ```python parser.add_argument("--output", "-o", help="输出文件路径（不含扩展名）") ``` The value subsequently reaches a shell command: ```python html_path, png_path = get_output_path(page_type, args.output) ``` ```python if args.open: print(f"\n🌐 打开 HTML...") os.system(f"open {html_path}") ``` ### Technical Analysis The `--output` argument controls the directory and base name used to construct `html_path`. When `--open` is enabled, that path is interpolated into `os.system()` without safe argument separation or shell escaping. `os.system()` executes its input through the shell. Consequently, shell metacharacters embedded in the output path can alter command structure and execute additional commands. The use of `pathlib.Path` does not sanitize shell syntax; it only represents the value as a filesystem path. ### Attack Path 1. An attacker persuades a user or automated workflow to invoke `main.py` with both `--open` and a crafted `--output` value. 2. `get_output_path()` incorporates the value into `html_path`. 3. The prototype is generated, after which the automatic-open branch executes. 4. The path is concatenated into `open ` and passed to `os.system()`. 5. The she ...[truncated 502 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: skills/htmlPrototype/analyze_platform.py:16
Finding: Bundled Private-Network Automation Uses Hard-Coded Administrator Credentials
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/postinstall.js:17
Finding: Post-Install Hook Automatically Installs Unpinned Global Dependencies
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: skills/requirement-reviewer/engines/semantic/ai_checker.py:103
Finding: PRD Content and API Credentials Can Be Sent to an Arbitrary Configured Endpoint
Content: View full analysis
Dict: """加载 API 配置""" # 尝试从环境变量加载 config = { "api_key": os.getenv("OPENAI_API_KEY", ""), "base_url": os.getenv("OPENAI_BASE_URL", "https://api.openai.com/v1"), "model": os.getenv("OPENAI_MODEL", "gpt-4o-mini") } # 尝试从配置文件加载 config_path = os.path.expanduser("~/.openclaw/workspace/skills/prd-workflow/config.json") if os.path.exists(config_path): try: with open(config_path, "r") as f: file_config = json.load(f) config.update(file_config) except: pass return config ``` PRD content is included in the prompt: ```python prompt = self.CHECK_PROMPT_TEMPLATE.format( check_name=check_item.name, check_description=check_item.description, check_points=check_points, example_good=check_item.example_good, example_bad=check_item.example_bad, section_title=task.section.title if task.section else "全文", content=task.content[:3000] if len(task.content) > 3000 else task.content ) ``` The content and bearer credential are sent to the configured endpoint: ```python headers = { "Authorization": f"Bearer {self.api_config['api_key']}", "Content-Type": "application/json" } data = { "model": self.api_config.get("model", "gpt-4o-mini"), "messages": [ {"role": "user", "content": prompt} ], "temperature": 0.3, "max_tokens": 1000 } response = requests.post( f"{self.api_config['base_url']}/chat/completions", headers=he ...[truncated 1933 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (410)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description claims a comprehensive PRD workflow skill covering multiple interactive and document-generation stages. The supplied code chunk does not implement that workflow. It only reads a local markdown file of quality-check definitions, parses structured sections, and emits a Python file with static data plus helper functions like filtering items, generating prompts, and computing stats. While this supports the 'quality check' portion of a PRD system, it does not substantiate the broader declared capabilities. Therefore the code's actual behavior is materially narrower and different from the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents an end-user PRD workflow tool focused on interview, analysis, PRD generation, review, flowcharting, quality checks, and Word export. The actual code chunk does not implement those workflow functions; instead, it is an installation/setup script whose purpose is dependency detection and package installation. While installing mermaid-cli or screenshot tools may support flowchart/export features, this code’s primary behavior is system modification and dependency management through shell execution, which is a materially different capability not reflected in the declared purpose or permissions. Therefore this code chunk is mismatched to the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents an end-user PRD authoring workflow with analysis, review, flowcharting, quality checking, Word export, and optional Wiki enhancement. The actual code does none of those workflow functions. Instead, it is purely a release-management/deployment script for publishing the skill/package. This is a materially different primary purpose and introduces undeclared capabilities involving local version manipulation, test execution, and remote publishing/inspection via the ClawHub CLI. Therefore the description does not accurately represent the behavior of this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is about an end-user PRD creation workflow with review, flowcharting, export, and optional Wiki enhancement. The supplied code does none of that. Instead, it is a repository maintenance utility for version updates: it reads workflows/version.js, optionally takes CLI arguments for a new version and changelog, updates multiple project files, and inserts changelog/history entries. This is a materially different primary purpose and introduces undeclared capabilities related to release/version management. Therefore the description does not accurately represent the code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is about a product-requirements-document workflow assistant, including interviewing, requirement analysis, PRD drafting, review, flowcharting, quality checks, and export. The supplied code does none of those core tasks. Instead, it is a browser automation script focused on analyzing a specific web application's product list page. It accesses a concrete internal URL, uses explicit login credentials, performs UI checks, takes screenshots, and outputs a Word report of issues and recommendations. While both mention Word export/report generation at a high level, that overlap is minor and insufficient: the primary purpose, behavior, and accessed resources are materially different from the declared PRD workflow.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description describes an end-to-end product requirements document workflow with multiple stages and export/integration features. The supplied code does not implement any of those functions. Instead, it simply retrieves an HTML template and performs basic keyword-based string replacement to customize page titles. This is a materially different primary purpose, so the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is about a product-requirements-document workflow system with multiple document-processing and review/export stages. The supplied code does not perform any PRD-related processing, workflow management, review logic, flowchart generation, document export, or Wiki integration. Instead, it is a front-end HTML template module for generating and modifying static UI pages with design tokens and accessibility tweaks. This is a materially different primary purpose, so the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description describes a product requirements document workflow tool, centered on interviewing, analyzing requirements, generating PRDs, reviewing them, creating flowcharts, performing quality checks, exporting to Word, and optionally enhancing with a Wiki knowledge base. The supplied code does something materially different: it generates HTML page prototypes from text or a requirements document, asks clarifying questions about UI details, customizes visual design, saves HTML and PNG outputs, and optionally opens the generated file. While there is light requirement parsing, it serves UI prototype generation rather than PRD workflow execution. This is a clear purpose mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description promises a broad, integrated PRD workflow covering multiple stages and outputs. The supplied code chunk only performs a narrow subtask: parsing requirement documents from local files and extracting structured hints for prototype/UI generation. Its primary purpose is materially different from the declared end-to-end PRD workflow, and many key advertised capabilities are absent. Additionally, the code introduces a more specific behavior—local document parsing for HTML/prototype generation—that is not represented in the description. This is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear description-behavior mismatch. The declared purpose describes a comprehensive product requirements document workflow with multiple document-processing and review stages. The actual code chunk is a minimal initializer for a screenshot module and only imports a screenshot function. Nothing in the provided code supports interview handling, requirement analysis, PRD generation, review, flowchart creation, quality checking, Word export, or Wiki integration. The code instead appears to belong to an unrelated screenshot capability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is about product requirements document workflow automation, including analysis, review, flowcharting, quality checks, and Word export. The supplied code does none of those tasks. Instead, it is a screenshot helper for rendering HTML files to PNG images, with multiple fallback mechanisms depending on available tools and OS. This is a materially different primary purpose, and it also uses capabilities not implied by the declaration, such as browser automation, subprocess execution, AppleScript invocation, and filesystem output of screenshots. Therefore the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises an end-to-end PRD workflow with review, flowcharting, quality checks, Word export, and optional Wiki enhancement. The supplied code does not implement or invoke those capabilities. Instead, it is a local test script for an interactive prototype/page-description workflow: it parses a page request, generates clarifying questions, and collects answers using mocked user input. This is a materially different primary purpose from PRD generation and export, so the description does not accurately represent the code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises a broad end-to-end PRD workflow with multiple stages and export/review features. The supplied code does none of that. It only accepts command-line arguments for diagram level, title, system name, and output path, then writes a predefined Mermaid C4 diagram template to a file. While flowchart/diagram generation is loosely related to one claimed feature, the primary behavior is specifically C4 architecture diagram generation, not integrated PRD workflow execution. This is therefore a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied code chunk does not implement the declared end-to-end PRD workflow. Its actual purpose is narrowly focused on rendering Mermaid diagram files by invoking the external mmdc command, with dependency checks for mermaid-cli and Chrome/Puppeteer. While 'flowchart' is mentioned in the declared description, this code only supports diagram rendering and does not perform interview, analysis, PRD authoring, review, export to Word, or wiki enhancement. This is a material description-behavior mismatch because the primary purpose of the code is substantially different from the declared skill purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a broad end-to-end PRD workflow skill, but the supplied code chunk only implements a narrow export function: Markdown-to-Word conversion with formatting and image insertion. There is no evidence of interview logic, requirement analysis, PRD drafting, review, flowchart generation, quality checking, or Wiki integration. Additionally, the module docstring mentions Word/PDF/HTML export, yet the actual implementation and CLI only save .docx output. This is a material description-to-behavior mismatch because the primary purpose of the code is document export rather than the declared full PRD workflow.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied code chunk only implements the export portion of the declared workflow. It accepts an input Markdown file, optional output and images directories, and runs a Python exporter to generate a Word document. There is no evidence in this code of interview handling, requirement analysis, PRD authoring, review, flowchart generation, quality checks, or Wiki integration. While 'Word export' is accurately represented, the overall declared description substantially overstates the behavior of this specific code chunk, so this is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents a broad, integrated PRD workflow skill with multiple stages: interviewing, requirement analysis, PRD generation, review, flowcharting, quality checks, export, and optional Wiki enhancement. The supplied code chunk only performs one specific review function: validating acceptance criteria within PRD content using regex-based checks and returning issues, score, status, and statistics. This is materially narrower than the declared purpose. There is no evidence here of interview handling, PRD generation, flowchart creation, Word export, or Wiki integration. While 'review' and 'quality check' are partially aligned, the overall description substantially overstates what this code chunk actually does, so this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The supplied code chunk is a narrowly scoped reviewer utility, not a complete PRD workflow. It parses PRD text, extracts headings, verifies presence of predefined sections, checks for missing keywords, computes a score, and returns completeness issues. While this partially aligns with the declared 'review' and 'quality check' concepts, it does not implement the broader declared functionality such as deep interview, requirement analysis, PRD generation, flowchart creation, export, or Wiki enhancement. Therefore the description materially overstates the code’s actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a broad end-to-end PRD workflow system with multiple stages and export features. The supplied code chunk instead has a specific and materially narrower purpose: checking PRD content for financial compliance requirements using predefined checkpoints and keyword matching. While 'review' and 'quality check' are mentioned in the description, the code’s primary behavior is domain-specific compliance validation, which is a distinct capability not explicitly represented in the declared purpose. It also does not implement most of the prominently declared workflow functions such as deep interview, requirement analysis, PRD generation, flowcharting, Word export, or Wiki enhancement. Therefore this chunk does not accurately match the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description promises a broad, end-to-end PRD workflow with multiple stages and export/integration features. The supplied code chunk only performs one limited subfunction: textual consistency checking on PRD content using regex-based rules. It detects mismatches in specific fields and terminology and computes a score. While this could fit as a small part of a 'review' or 'quality check' stage, it does not substantiate most of the declared capabilities. Therefore the description materially overstates what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a comprehensive multi-step PRD workflow with several major capabilities beyond review. The supplied code only performs one narrow part of that lifecycle: checking/reviewing PRD content and reporting issues. It does not conduct interviews, generate PRDs, create flowcharts, export Word documents, or integrate a Wiki knowledge base. While 'review' and 'quality check' are loosely related to the description, the primary purpose of this code chunk is materially narrower and different from the declared end-to-end workflow. Therefore this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a broad, end-to-end PRD workflow skill with multiple stages and export/integration features. The supplied code chunk, however, is just an init.py that imports and exports four generic review checker classes. Its observable behavior is limited to organizing requirement-review components, not implementing the larger workflow described. While this review functionality may be one supporting part of the declared system, the code chunk itself materially underrepresents the declared primary purpose and only aligns with the 'Review' portion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a broad, integrated end-to-end PRD workflow skill with multiple stages and export/knowledge-base features. The supplied code chunk only performs static analysis of a PRD's acceptance-criteria section and returns issues, score, status, and statistics. This is a materially narrower and different capability than the declared primary purpose. There is no evidence in this chunk of interview orchestration, requirement analysis pipeline, PRD generation, flowcharting, Word export, or Wiki integration. While the checker could be a supporting subcomponent of a larger PRD review workflow, by itself it does not accurately represent the declared full skill behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a full-stack PRD workflow skill covering multiple stages from interview through export. The supplied code only performs semantic review of existing PRD content and returns scored issues. That review step is consistent with one subset of the declared workflow, but the code chunk’s actual purpose is materially narrower than the declared skill purpose. There are no suspicious extra permissions or resource accesses, but the primary behavior in this chunk does not match the broad end-to-end functionality claimed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The supplied code chunk is narrowly focused on reviewing a document’s internal consistency using regex-based checks and a scoring mechanism. While this could fit as one small part of a broader 'review' or 'quality check' stage, it does not substantiate the declared end-to-end skill description. The description claims a comprehensive workflow including deep interview, requirement analysis, PRD generation, review, flowchart generation, quality check, and Word export, plus optional Wiki enhancement. None of those broader workflow capabilities are present in this chunk. The actual code is materially narrower and domain-specific, so the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.