SPM - Super Project Manager

AdvisoryAudited by Static analysis on May 13, 2026.

Overview

Detected: suspicious.destructive_delete_command

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

The skill may edit project files, run local commands, use browser automation, and coordinate other agents during development tasks.

Why it was flagged

The skill requests broad local editing, command execution, process, browser, session, and subagent capabilities. This is expected for a software project manager, but these tools can make high-impact changes if misused.

Skill content

allowed-tools: ["read", "write", "edit", "exec", "process", "sessions_spawn", "sessions_yield", "subagents", "cron", "memory_search", "memory_get", "browser"]

Recommendation

Use it in trusted project directories, review phase approvals, and confirm before deployments, dependency changes, database changes, or destructive commands.

NoteHigh Confidence

ASI06: Memory and Context Poisoning

What this means

If the WBS ledger or project notes contain incorrect, stale, or malicious instructions, they could shape later agent behavior.

Why it was flagged

The skill intentionally reuses WBS ledger/task context across tool calls. This is central to its workflow, but persistent or project-controlled context can influence future agent actions.

Skill content

**Hook Auto-Injection** | Active tasks auto-injected into context before every tool call

Recommendation

Keep `docs/spm/ledger.md` under review, avoid pasting untrusted instructions into task context, and treat hash attestation as integrity protection rather than proof that content is safe.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Multiple agent sessions may see parts of the project plan, code context, and task evidence.

Why it was flagged

The skill is designed to hand work to subagents and bind them to WBS tasks. This is purpose-aligned, but it means project context and task details may be shared across agent sessions.

Skill content

**Subagent Dispatch** — Parallel and sequential task execution with automatic WBS binding

Recommendation

Use subagent mode only for projects where sharing relevant project context across agents is acceptable, and prefer step-by-step confirmation for sensitive work.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

A future repository change could alter what gets installed if the user follows the clone command without pinning a version.

Why it was flagged

The install documentation uses an unpinned GitHub clone rather than a fixed commit or release artifact. It is manual and disclosed, but users depend on the repository contents at clone time.

Skill content

git clone https://github.com/zhbcher/openclaw-spm.git ~/.openclaw/skills/spm

Recommendation

Install from a trusted release, tag, or reviewed commit when possible, and inspect scripts before enabling the skill.

NoteMedium Confidence

ASI10: Rogue Agents

What this means

The skill may maintain project progress state and coordinate ongoing work during an active project.

Why it was flagged

The documented configuration enables recurring heartbeat/checkpoint behavior and parallel subagents by default, while deployment is disabled by default. This is disclosed and related to session recovery, but it is persistent project-management behavior.

Skill content

"heartbeat_interval": "10m", "auto_checkpoint": true, "parallel_subagents": true, "deployment_enabled": false

Recommendation

Disable auto-checkpointing or parallel subagents if you do not want ongoing project-state automation.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Running the command with the wrong path or shell expansion could delete local files.

Why it was flagged

The upgrade guide includes a destructive delete command, but it is a manual, scoped removal of this skill's own workspace directory before replacement.

Skill content

rm -rf ~/.openclaw/workspace/spm
tar xzf spm-skill-v2.tar.gz -C ~/.openclaw/workspace/

Recommendation

Verify the path before running upgrade commands and back up any local modifications under the skill directory.

Findings (1)

warn

suspicious.destructive_delete_command

Location: INSTALL.md:102
Finding: Documentation contains a destructive delete command without an explicit confirmation gate.