Security audit

Pm Master

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate project-management automation skill, but it has broad state-changing authority and several under-scoped side effects that users should review before installing.

Install only if you want a strongly opinionated PM automation system that can create and change project files, run local scripts, dispatch sub-agents, and send approved emails. Review config.yaml before use, consider disabling email unless needed, prefer dry-run paths for SOW parsing and gate changes, and watch for project.yaml modifications in version control.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (30)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The skill is presented as a project-management helper, but it also documents materially broader behaviors: file creation/modification, subprocess-style execution flow, web access, document rendering, workspace scanning, and external communications. This mismatch reduces informed consent and can cause the skill to be invoked in contexts where users do not expect stateful writes, network activity, or broad workspace interaction, increasing the risk of unintended data exposure or destructive changes.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The orchestration handbook instructs the PM skill to route technical work to external domain-expert sessions in the WorkBuddy Expert Center, expanding behavior beyond the declared PM-only scope. This creates a scope-boundary violation: users invoking a project-management skill could unintentionally trigger other expert systems with broader capabilities or different trust boundaries, increasing the chance of unauthorized actions, data over-sharing, or policy bypass through cross-agent delegation.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The file authorizes drafting communications and sending them via comm_send.py through an approval gate, which is an outward-facing action not disclosed in the manifest's stated PM artifact scope. Even with an approval gate, embedding send-capable behavior in a planning skill can lead to unexpected external communications, privacy leaks, or social-engineering abuse if a user or downstream agent causes the skill to prepare and transmit messages to real contacts.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The playbook explicitly states that WBS data is automatically written into project.yaml without human approval. In a project-management skill, auto-modifying core planning artifacts based on parsed contract text and Q&A can propagate parsing errors or adversarial input directly into source-of-truth project data, causing unauthorized or incorrect plan changes.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The script documents `--no-write-back` as preventing changes to `project.yaml`, but still rewrites that file at the end to update `artifacts`. This violates user expectations for a read-only mode and can cause unintended state changes, config drift, or corruption of the source-of-truth file in automated pipelines that rely on non-mutating execution.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: This file introduces a repository-wide confidentiality and leak-scanning capability inside a project-management skill, which is outside the advertised PM scope. Even if intended as a release-quality check, it expands the skill’s operational surface to inspect all files and binary contents, creating an unnecessary data-discovery capability that could expose or process sensitive information beyond what users expect from this skill.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The implementation walks the entire package, opens every file in binary mode, decodes text when possible, and scans even raw bytes for sensitive tokens. In a PM skill context, this is a mismatched capability that enables broad content inspection of unrelated assets, increasing the risk of overcollection, accidental disclosure in logs/output, and scope creep into security/compliance functions.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The file-level documentation explicitly claims the script only audits and generates plans without modifying project.yaml, but the generated brief tells downstream agents to '回写 project.yaml 的 wbs 列表' (write back to project.yaml). That mismatch can mislead operators or orchestrators into granting this tool broader trust than warranted, causing unintended state changes when child agents follow the brief.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The docstring states that the driver will automatically trigger control_engine.py inspections, but the implementation only prints a suggested command and later may stamp last_control_check without ever running the inspection. In a project-management automation context, this can create a false assurance that governance checks occurred, allowing overdue or skipped controls to go unnoticed and weakening process integrity.

Description-Behavior Mismatch

Medium

Confidence: 83% confidence
Finding: The execution driver mutates project.yaml by writing last_control_check, even though its role is presented as status derivation/reporting. This side effect can silently alter source-of-truth project state, and in combination with the missing actual inspection, it can suppress future control prompts and mislead downstream tooling or users into believing checks were performed.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The comment claims the timestamp is persisted only in the real inspection branch, but the code writes last_control_check whenever a control check is needed and output is non-JSON. That means merely running the driver can mark an inspection as completed without executing it, defeating cadence enforcement and creating an audit-trail integrity problem.

Context-Inappropriate Capability

Medium

Confidence: 80% confidence
Finding: The script allows configuration to be read from an arbitrary filesystem path via the PM_MASTER_CONFIG environment variable. In an agent setting, environment variables are often influenced by deployment or wrapper processes, so this can expose unintended local files or let untrusted configuration alter runtime behavior beyond the skill’s narrow project-state purpose. The risk is somewhat limited because this code only reads and prints/uses parsed config rather than executing it, but it still expands the trust boundary unnecessarily.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The README advertises a very broad natural-language trigger such as telling the agent to 'use agile to help me initiate the payment refactor project,' while the skill metadata also lists many generic PM-related trigger terms. Broad activation criteria can cause the skill to engage in contexts where the user did not explicitly intend to invoke it, increasing the chance of unintended file creation, script routing, or workflow enforcement. In this skill, that risk is amplified because the skill is designed to always produce artifacts and may orchestrate multiple agents or scripts once activated.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill description and trigger terms are extremely broad, covering common workplace language such as project, program, status report, milestone, kickoff, agile, and risk register. This can cause unintended invocation in many normal conversations, and because the skill has powerful capabilities including Write, Edit, Bash, Agent, WebFetch, and WebSearch, accidental activation increases the chance of unnecessary file changes, tool execution, and over-collection of context.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger surface is extremely broad, covering many generic PM and delivery terms. In a system that auto-selects skills, this can cause unintended invocation of a highly stateful and tool-rich skill on loosely related requests, leading to unnecessary file writes, web usage, or workflow enforcement in contexts where the user only wanted lightweight advice.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The operational rules mandate creating files, modifying `project.yaml`, rendering artifacts, and running checks, but the user-facing description does not clearly warn that the skill will persistently alter workspace state. Hidden stateful behavior is dangerous because users may invoke the skill expecting guidance, while it instead creates or mutates project files and workflow artifacts automatically.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The manifest includes `WebFetch` and `WebSearch`, and the workflow references external communication/email capabilities, yet the description does not warn users about possible network or web operations. Even if such access is legitimate, undisclosed network behavior can expose sensitive project context to remote systems or surprise users in restricted environments.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrases are broad enough that routine project-management text could accidentally match domain-expert roles and cause unintended dispatch. In this skill, dispatching a wrong expert can produce irrelevant or overly specialized sub-agent outputs, which may mis-scope work, create incorrect artifacts, or amplify downstream prompt-routing errors across multiple agents.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The catalog defines many ambiguous triggers without scope boundaries, making role selection susceptible to misrouting from ordinary terms like 'testing', 'integration', or 'security'. Because this file feeds sub-agent system prompts for technical decomposition, incorrect routing can systematically generate wrong work packages and contaminate planning artifacts, especially in a multi-agent orchestration flow.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The instructions mention sending formal notifications through comm_send.py but provide no explicit user-facing warning that external recipients may be contacted. That omission is dangerous because users may believe they are only generating PM documents, while the skill can transition into real-world messaging behavior that exposes project details or initiates unintended contact.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The document provides executable approval commands that mutate project state (`lifecycle_state → closed`, phase change, gate recording) but does not prominently warn that these commands modify project files and workflow state. In an agent skill context, this increases the chance an automated agent or user invokes the approval path without understanding the side effects, potentially causing premature closeout or unauthorized state transitions.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger text includes broad phrases such as 'program', 'portfolio', and 'large cross-department plan', which can match many ordinary planning requests outside the intended scope. This can cause the skill to activate inappropriately, leading the agent to steer users into program-management workflows, files, or automation they did not request.

Vague Triggers

Low

Confidence: 75% confidence
Finding: The activation condition for the two-tier WBS mode is described in natural language but does not define clear entry criteria or exclusivity rules. Ambiguous activation can make the agent apply a specialized decomposition model when the user did not intend milestone-only program views, causing incorrect planning outputs or loss of expected detail.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The skill mandates specific non-user-requested language and locale content, including Chinese text and INR-denominated billing fields, as part of the output structure. Forcing locale-specific wording without user opt-in can override user preferences, corrupt downstream artifacts, and produce misleading commercial or documentation outputs in environments expecting a different language or currency.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The document describes automatic writes to project.yaml with no warning, review gate, or consent step. Because the skill processes untrusted contract text and clarifications, silent writes increase the chance of unintended state changes and make it easier for malformed or adversarial input to alter planning artifacts without operator awareness.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/control_engine.py:578