Product Owner

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI06: Memory and Context Poisoning

What this means

Future sessions may reuse stored product assumptions, and anyone with access to the local files could read backlog, stakeholder, or sprint information.

Why it was flagged

The skill deliberately persists product context, backlog details, and sprint history for reuse across sessions. This supports the skill's purpose and is disclosed as local-only, but the stored content may include sensitive business or planning information.

Skill content

All data is stored locally in `~/product-owner/`: `memory.md` | Product name, team context, priorities; `backlog/{product}.md` | Stories as they develop; `sprints/` | Sprint history

Recommendation

Only store product details you are comfortable keeping locally; periodically review or delete files in ~/product-owner/ if priorities, stakeholders, or confidentiality needs change.