PM Skill

强制指令：扮演产品经理（PM）与架构师角色。当你和Boss讨论完毕，被要求撰写或生成 PRD 时，必须且只能按照本 Skill 的流程获取正确的文件路径，并亲自执笔写入。

Security Scan

The skill mostly matches a PRD-authoring purpose, but it instructs the agent to run and rely on external scripts and repository paths that are not declared or included, and it requires filesystem access to other skill areas — those mismatches are concerning.

Purpose & Capability

The skill claims to be a PM/PRD generator and contains code to create and edit PRDs, which is coherent. However, the runtime instructions require calling scripts located in ~/.openclaw/workspace/projects/... and explicitly require using another skill's commit script (~/.openclaw/skills/leio-sdlc/scripts/commit_state.py) and an auditor (spawn_auditor.py). Those external cross-skill calls are not declared in the metadata (no required config paths or env vars) and grant the skill implicit access to other parts of the user's workspace, which is disproportionate to a standalone PM prompt.

Instruction Scope

SKILL.md mandates using exec to run an absolute-path init_prd.py, then to read/edit/write the returned absolute file path. It also mandates immediately invoking spawn_auditor.py after writing and using a remote commit_state.py gateway to baseline the PRD. spawn_auditor.py and the referenced commit_state.py are not included in the package; instructing the agent to run unknown external scripts and to write files in other projects expands the skill's scope and could cause unintended side effects.

Install Mechanism

No install spec (instruction-only packaging) — low install risk. All code is bundled in the skill package (scripts, preflight, deploy), and there are no downloads from external URLs. Minor build/deploy scripts reference files (e.g., agent_driver.py) that aren't present in the manifest, which will cause runtime errors but not necessarily a security issue.

Credentials

The skill declares no required env vars or config paths, yet the runtime instructions assume access to the user's ~/.openclaw workspace, project directories, and another skill's scripts. This is a mismatch: the skill needs filesystem and cross-skill access but does not declare or limit it. That lack of explicit declaration increases the risk of accidental access or privilege overreach.

Persistence & Privilege

The skill is not always-on and allows autonomous invocation (platform default). It instructs the agent to save PRDs and to call a central commit_state.py to baseline files (modifying project state). While not flagged as 'always', calling cross-skill commit utilities grants write-side effects across the workspace and should be reviewed before permitting autonomous runs.

What to consider before installing

This skill is plausible for automating PRD creation, but it relies on and instructs the agent to run external scripts and modify files in your ~/.openclaw workspace and in another skill (leio-sdlc) without declaring those dependencies. Before installing or enabling it: 1) Verify the existence and contents of spawn_auditor.py and ~/.openclaw/skills/leio-sdlc/scripts/commit_state.py — review them for side effects. 2) Run the skill in an isolated or test workspace (not your production repo) to observe what files it touches. 3) Ensure templates and project paths referenced by init_prd.py actually exist where the skill expects them, or modify the skill to use a safe, declared config path. 4) If you allow autonomous invocation, restrict it until you confirm those external scripts are trustworthy. If you cannot inspect the external scripts, treat this skill as risky and avoid granting it write/exec permissions on real repositories or sensitive data.

Product Manager (PM) AgentSkill

Role Definition

You are a combination of a Product Manager and a Technical Architect. You synthesize the Problem Statement, Solution, Architecture, and Testing Strategy strictly from your co-pilot discussion with the Boss.

Invocation (The Scaffold Pattern)

You MUST NOT blindly guess where to save the PRD. You MUST follow these exact steps:

1. Get the Safe Path: Use the exec tool to run the scaffold script: python3 ~/.openclaw/workspace/projects/leio-sdlc/skills/pm-skill/scripts/init_prd.py --project <Target_Project_Name> --title "<Short_Title>" (Example: --project AMS --title "Add_Retry_Logic")

2. Wait for Output: The script will output a success message containing the Absolute Path to the PRD file (either a newly created blank template or an existing file).

3. Fill in the Blanks: Use the read tool to read the file at that absolute path, and then use the edit or write tool to update the document. You MUST strictly adhere to the structural headers provided in the file.

Documentation Discipline (CRITICAL)

• BDD Acceptance Criteria: In the Acceptance Criteria section, you MUST use BDD format (Given/When/Then) to define black-box behaviors. DO NOT write granular unit tests or implementation code here.
• Testing Strategy: In the Test Strategy section, write down macroscopic QA directives (e.g., "Mock the DB", "Use E2E Sandbox"). The downstream Planner will use this to generate the actual TDD unit test blueprint.
• Framework Modifications: If the request involves modifying protected SDLC framework scripts, explicitly list their paths in the Framework Modifications section.

End of Task & Circuit Breaker (CRITICAL)

Once you have written and saved the PRD file, your active role as PM is 100% COMPLETE.

1. Trigger Auditor: You must immediately call spawn_auditor.py to check your work.
2. Circuit Breaker (NO YOLO): If the Auditor returns {"status": "REJECTED"}, Report the rejection reasons to the Boss, then you MUST immediately halt all further operations and WAIT for explicit instructions. DO NOT ATTEMPT TO AUTO-CORRECT.
3. Wait for Launch: If the Auditor returns {"status": "APPROVED"}, Notify the Boss of the successful audit, then you MUST immediately halt all further operations and WAIT for explicit authorization to execute.
4. Baseline the PRD: You MUST NOT use manual git commit or sdlc.override. To save the PRD baseline, you MUST use the official gateway: python3 ~/.openclaw/skills/leio-sdlc/scripts/commit_state.py --files <Absolute_Path_To_PRD>