ClawHub
Back to skill

Security audit

prd-writer

Security checks across malware telemetry and agentic risk

Overview

This is a simple PRD-writing skill whose behavior is disclosed and limited to generating structured product-requirements documents.

Install this if you want a Chinese-oriented PRD drafting workflow. Be aware it may activate for adjacent product-planning requests, so specify your desired language and whether you want a full PRD when prompting.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The invocation description uses broad triggers such as 写PRD、产品方案、产品定义、产品立项 without clear boundaries, which can cause the skill to activate for loosely related requests and override more appropriate skills or user intent. Over-broad routing increases the chance of unintended execution, data exposure to the wrong workflow, and unreliable behavior in multi-skill environments.

Natural-Language Policy Violations

Medium
Confidence
83% confidence
Finding
The skill content is entirely Chinese-oriented and implies Chinese-language interaction without documenting user opt-in, locale detection, or fallback behavior. This can cause user-intent mismatch, reduced transparency, and incorrect handling of requests from users expecting another language, which is a policy and usability risk rather than a direct code-execution issue.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.