ClawHub
Back to skill

Security audit

AI PM Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed product-management document workflow that writes planning files, with some practical caution around broad activation and root-level output files.

Before installing, be aware that this skill may activate on broad product-management phrases and is designed to create or update Markdown files in the project root. Check whether DISCOVERY.md, PRD.md, EXPERIMENT.md, or GTM.md already exist before running it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger description is extremely broad and includes many common product-management phrases, which increases the chance the skill will activate for ordinary planning or analysis requests the user did not intend to route through this workflow. Unintended invocation can cause unnecessary subagent spawning and downstream file-writing behavior, making this more than a UX issue in the context of a multi-phase agent that modifies the workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs subagents to write artifact files but does not clearly warn the user that workspace files will be created or potentially overwritten. This is dangerous because users may invoke a research or PM task expecting advice only, while the agent performs persistent modifications in the project root.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The output section formalizes creation of multiple root-level files across phases but does not define overwrite protections, directory isolation, or confirmation gates. In a skill that can run phases independently and chain outputs, this creates a realistic risk of clobbering existing documents or leaving unwanted artifacts in the repository.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

Example invocation text such as wanting to build a product idea or run the agent on a problem statement is generic enough that many normal conversations could match it. In this skill, that matters because invocation is tied to orchestrating multiple phases and generating artifacts, so accidental activation may lead to unintended actions and noisy workspace changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.