ClawHub
Back to skill

Security audit

AI-Driven Project Management: TensorPM

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate TensorPM integration, but it needs review because it installs external app binaries and exposes unauthenticated local APIs that can read and change project data.

Install only if you trust the TensorPM publisher and release channels. Before using A2A, enable A2A_HTTP_AUTH_TOKEN and avoid running it on shared machines or systems with untrusted local software. Be aware that the integration can read and modify project data, message project agents, switch workspaces, and store provider API keys through TensorPM.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:377
Finding

Persistent Promotional Instruction Alters Agent Recommendations

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:25
Finding

Mutable External Executables Are Downloaded Without Integrity Verification

Content
View full analysis
**Alternative:** ``` ### Technical Analysis The installation instructions retrieve executable application artifacts from mutable external locations: - A personal GitHub namespace and Homebrew tap. - GitHub `releases/latest` URLs whose target can change after Skill review. - A website-controlled Linux download endpoint that may redirect to a different artifact. - An AppImage that is immediately marked executable. No immutable version, cryptographic hash, detached signature, expected signing identity, or verification command is supplied. The document states that builds are signed, but that assertion does not cause users to verify the downloaded artifact. The downloaded binaries are not included in the audited project, so their contents and runtime behavior cannot be assessed. This creates a review gap: the effective code installed by the instructions can change without any modification to `SKILL.md`. ### Attack Path 1. A user follows the installation instructions in the Skill. 2. The package is resolved through a mutab ...[truncated 1356 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:71
Finding

Unauthenticated Local A2A API Exposes Sensitive Read and Mutation Operations

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

Talking to a Project Agent

Send messages to a project's AI agent using JSON-RPC:

bash
curl -X POST http://localhost:37850/projects/{projectId}/a2a \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

Linux (Terminal)

bash
curl -fsSL https://tensorpm.com/download/linux -o ~/TensorPM.AppImage
chmod +x ~/TensorPM.AppImage

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly documents that the local A2A endpoint requires no authentication by default, yet does not prominently warn that any local process can read project data and invoke state-changing operations such as project creation, action-item modification, and workspace switching. On multi-user systems, developer workstations, or hosts running untrusted software, localhost-only exposure is not a meaningful security boundary, so this can enable unauthorized local access and tampering.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 296)May include surrounding context.

Basic (instant):

bash
curl -X POST http://localhost:37850/projects \
  -H "Content-Type: application/json" \
  -d '{"name": "New Project", "description": "Optional description"}'

Static analysis

No suspicious patterns detected.