ClawHub
Back to skill

Security audit

PM — AI Product Manager Skill

Security checks for vulnerabilities and agentic risk

Overview

This PM skill is mostly coherent, but it asks the agent to continuously collect, retain, and act on broad company and stakeholder information without enough scoping or approval safeguards.

Install only if you are comfortable using the agent as a high-agency PM over sensitive product operations. Before use, set explicit boundaries for which repositories, chat exports, docs, analytics, and stakeholder details it may review; require confirmation before it writes, deletes, or reorganizes records; and avoid storing personal relationship judgments unless that fits your team's privacy policy.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill states the model cannot access live systems, then later directs it to perform daily scans of GitHub and chat channels. That contradiction can push an agent to over-claim capabilities, improvise unauthorized data access paths, or pressure the user to provide broad operational data it should not routinely ingest. In a PM skill, this is especially risky because those systems often contain sensitive roadmap, customer, personnel, and security information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation text is so broad that it can trigger on a wide range of ordinary product-related discussions, causing the skill to take over conversations where a narrower or safer behavior would be more appropriate. Over-broad activation increases the chance of unnecessary authority, excessive instruction loading, and unintended access to sensitive business context. In this skill, that risk is amplified because the persona is told to 'be the PM' and drive decisions autonomously.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill expands from product decision support into maintaining a persistent people registry and broad knowledge base, increasing data collection and retention beyond the stated PM role. This creates unnecessary accumulation of personal, organizational, and potentially confidential information, which raises privacy and prompt-scope risks if the agent stores or reuses that context across tasks. The PM context makes this more dangerous because stakeholder notes and relationship health data can include sensitive personnel judgments.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · evals/evals.json (reported line 71)May include surrounding context.

json
"id": 10,
      "category": "market-intelligence",
      "prompt": "Our main competitor just launched a feature that lets users export reports in 15 formats. We currently support 3. Half my team is panicking. What do we do?",
      "expected_output": "Does not panic or immediately add 'support 15 export formats' to the roadmap. First assesses the competitive signal: how much do users actually use export, which formats do our users specifically need, is this a feature our target segment cares about or is the competitor targeting a different segment? Looks at G2/Reddit signal to see if export breadth is a purchase decision factor. Then gives a recommendation: either a targeted response (add the 2-3 formats users actually need most based on data), a 'not a response' call (if the segment doesn't care), or a deeper investigation spike. Produces a one-paragraph competitive brief. Does NOT say 'let's match all 15 formats' without checking user demand.",
      "files": []
    },
    {

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/change-sensing.md (reported line 139)May include surrounding context.

md
"id": 10,
      "category": "market-intelligence",
      "prompt": "Our main competitor just launched a feature that lets users export reports in 15 formats. We currently support 3. Half my team is panicking. What do we do?",
      "expected_output": "Does not panic or immediately add 'support 15 export formats' to the roadmap. First assesses the competitive signal: how much do users actually use export, which formats do our users specifically need, is this a feature our target segment cares about or is the competitor targeting a different segment? Looks at G2/Reddit signal to see if export breadth is a purchase decision factor. Then gives a recommendation: either a targeted response (add the 2-3 formats users actually need most based on data), a 'not a response' call (if the segment doesn't care), or a deeper investigation spike. Produces a one-paragraph competitive brief. Does NOT say 'let's match all 15 formats' without checking user demand.",
      "files": []
    },
    {

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/session-handoff.md (reported line 123)May include surrounding context.

md
"id": 10,
      "category": "market-intelligence",
      "prompt": "Our main competitor just launched a feature that lets users export reports in 15 formats. We currently support 3. Half my team is panicking. What do we do?",
      "expected_output": "Does not panic or immediately add 'support 15 export formats' to the roadmap. First assesses the competitive signal: how much do users actually use export, which formats do our users specifically need, is this a feature our target segment cares about or is the competitor targeting a different segment? Looks at G2/Reddit signal to see if export breadth is a purchase decision factor. Then gives a recommendation: either a targeted response (add the 2-3 formats users actually need most based on data), a 'not a response' call (if the segment doesn't care), or a deeper investigation spike. Produces a one-paragraph competitive brief. Does NOT say 'let's match all 15 formats' without checking user demand.",
      "files": []
    },
    {

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest says this skill should act as 'the Product Manager' for prioritization, PRDs, roadmaps, stakeholder alignment, and product decisions. This file instead provides a dedicated data-analysis playbook centered on metrics frameworks, anomaly investigation, and A/B test methodology, which is a narrower analytics function than the manifest claims.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

As a markdown file, this skill should warn about behaviors that could affect user data or record integrity. The audit step asks whether notes should be 'filed or deleted' but provides no caution about confirming obsolescence, preserving history, or avoiding accidental loss of useful documentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.