Security audit

PM Skill

Security checks across malware telemetry and agentic risk

Overview

This PRD-writing skill has a plausible purpose, but it asks agents to run unreviewed local scripts and includes broad operational helpers that can modify installed OpenClaw state.

Review before installing. Use only trusted project names, confirm the generated PRD path before allowing writes, and do not allow spawn_auditor.py, commit_state.py, deploy.sh, rollback.sh, or preflight.sh to run unless you know exactly which local code will execute and are comfortable with changes to your OpenClaw installation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill clearly instructs the agent to read and write files, yet it declares no corresponding permissions. This creates a governance gap: operators and policy engines cannot accurately understand or constrain what the skill will do, making unauthorized file access harder to detect and review.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a PRD-writing workflow, but the documented behavior extends into executing local scripts, auditing, baselining, and potentially broader SDLC operations. This mismatch is dangerous because users may invoke it under the assumption of a narrow documentation role while it actually gains leverage over operational workflows and local tooling.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Requiring use of a general exec tool for a PM-oriented skill grants a much broader execution surface than needed for drafting documents. Even if the example command is specific, the pattern normalizes shell execution inside a documentation workflow and can be abused if parameters or called scripts are influenced by untrusted input.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The skill expands from PRD drafting into invoking local audit and commit scripts, which increases authority and side effects beyond document creation. This broadens the blast radius from content generation to workflow control and repository state changes, especially if these scripts run with elevated local trust.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The design explicitly expands the skill from local PRD compilation into live network retrieval via `web_search` for unknown archetypes. That broadens the trust boundary, introduces prompt-injection and data-exfiltration/privacy risk from external content, and is not necessary for a path-controlled document writer. In this skill context, the risk is higher because the skill is supposed to produce structured internal artifacts, so adding autonomous web access increases capability beyond the stated narrow purpose.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The web-search behavior is not clearly justified by the manifest's stated role of controlled PRD generation, indicating capability creep. Unnecessary external access increases attack surface and can cause the agent to ingest malicious or low-quality content that then influences generated requirements or downstream execution plans. Because this skill is framed as a constrained PM writer, the mismatch makes the behavior more suspicious and less defensible.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The rollback script deletes the live skill directory and restores files from a backup archive, which is far beyond the declared PM/PRD-writing purpose of this skill. In this context, bundling deployment-changing behavior into a content-authoring skill increases the risk of unauthorized or unexpected modification of installed code, especially if the script is invoked automatically or by a confused user.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: Restarting the gateway service gives the skill operational control unrelated to its stated business function, enabling disruption or activation of newly restored code without clear user intent. In a PRD-writing skill, service restart functionality is especially suspicious because it can change runtime state and availability of the host environment.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The script joins user-controlled --project directly into /root/.openclaw/workspace/projects without validating that it is a simple project name. An attacker can supply values like ../../otherdir to escape the intended projects directory and cause the script to create docs/PRDs and write a PRD_*.md file in arbitrary reachable locations, which exceeds the skill’s narrow purpose and can overwrite or plant files in unintended project trees.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The invocation condition is broad and conversationally triggered, making accidental activation more likely during ordinary discussion with the 'Boss'. In context, accidental activation is more dangerous because the skill performs file creation and other tool-driven actions, not just passive text generation.

Missing User Warnings

Low

Confidence: 76% confidence
Finding: The design instructs the agent to use the `write` tool to save files without any user-facing confirmation or warning. Silent file creation/modification can surprise users, overwrite expected outputs, or be abused to persist unwanted content in the repository. In this context the danger is moderated by the target being a PRD directory, but it still represents an unsafe side effect without consent boundaries.

Missing User Warnings

Low

Confidence: 74% confidence
Finding: The PRD specifies web search behavior but provides no privacy, network-use, or external-content warning. Users may not expect their prompts or derived queries to be sent externally, and the agent may retrieve adversarial content without disclosure. In this skill context, that omission matters because the advertised function is local document generation, so network activity is less expected.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script builds shell commands as strings and executes them with eval, which is dangerous because eval re-parses the command and allows shell metacharacters embedded in filenames or other interpolated values to alter execution flow. In this script, discovered test file paths from the repository are inserted into eval-built commands, so a maliciously named file or crafted project content could trigger unintended command execution during preflight.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: Running npm test executes the project's test script, which is fully controlled by package.json and may launch arbitrary subprocesses or perform side effects. In an agent skill context, especially one intended to write files and operate inside potentially untrusted project repositories, this increases risk because simply invoking preflight can execute attacker-controlled code without explicit operator awareness.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script performs an unconditional `rm -rf` on the production directory before restoration, with no confirmation, dry-run mode, or safety checks beyond variable quoting. This creates a real risk of destructive data loss or service breakage if the wrong environment is targeted, the backup extraction fails, or the script is triggered unexpectedly.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.