Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
3skill
v1.0.0Create and manage Product Requirements Documents (PRDs) by defining user stories with verifiable acceptance criteria and tracking progress by priority order.
⭐ 0· 49·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (create/manage PRDs and user stories) align with the provided templates and runtime instructions: prd.json, progress.txt, story lifecycle, and git workflow. The files and examples relate to coding work and PRD execution, so requested capabilities match purpose.
Instruction Scope
SKILL.md and references direct agents to read and modify local repo files (prd.json, progress.txt), create/check out branches, implement code, run checks, commit changes, and update prd.json. Those actions fit the stated goal but carry high-impact side effects (modifying code, committing). More importantly, examples include an unattended infinite loop and a concrete example using `claude --dangerously-skip-permissions`, which explicitly suggests bypassing safety checks — this is out-of-band risk and should be treated with caution.
Install Mechanism
Instruction-only skill with no install spec, no binaries, and no external downloads. Nothing will be written to disk by the skill itself; risk from install mechanism is minimal.
Credentials
The skill declares no environment variables, no credentials, and no config paths. The documentation references agent CLIs (Claude, OpenCode) and git but does not request unrelated secrets or credentials in metadata.
Persistence & Privilege
Skill is not always-enabled and does not request persistent privileges, which is appropriate. However, its documentation encourages running autonomous agent loops that modify a repository and suggests disabling agent permission checks in examples — combining autonomous execution with instructions to bypass safety increases practical risk even though the skill metadata itself does not request elevated platform privileges.
What to consider before installing
This skill is essentially a PRD template + agent-run instructions. That is coherent, but be careful before using it autonomously: 1) Do not run infinite unattended loops against your main repo; use isolated worktrees or throwaway test repos. 2) Never use flags like `--dangerously-skip-permissions` or other options that bypass agent safety — they defeat platform protections. 3) Require human review of any agent-made commits (use pull requests, branch protection, CI). 4) Backup your repo and run agents in a sandboxed environment first. 5) If you intend to allow an agent to commit code, restrict its scope (single worktree, limited filesystem access) and audit progress.txt and prd.json updates. These steps will reduce the risk of unintended or damaging automated changes.Like a lobster shell, security has layers — review code before you run it.
latestvk978s3b3mhqh7jjvaqf4y7a4yh83m46a
License
MIT-0
Free to use, modify, and redistribute. No attribution required.