Software Manager Skill

软件产品经理/软件开发经理知识技能。当用户需要产品经理级别的专业支持时触发，包括： 需求分析、PRD撰写、产品设计、产品路线图规划、竞品分析、数据分析； 或用户询问产品经理职责、如何成为产品经理、产品经理技能要求； 或需要产品架构图、流程图、时序图、甘特图等 Mermaid 图表； 或需要从0到1输出PRD文档并...

What to check before installing or running this skill: 1) Review the two executable scripts (scripts/mermaid_render_multi.js and scripts/prd_export.py) before running. Confirm they only: detect a local browser to spawn headless rendering, write files to locations you specify, and fetch only expected resources (mermaid/Tailwind). Look for any hardcoded remote endpoints, command-exec of attacker-supplied strings, or unexpected network calls. 2) Inspect SKILL.md for the reported unicode control characters (prompt-injection signal). Those characters can be used to hide or alter prompts; if present, ask the author why they are there or remove them prior to use. 3) When running rendering or export: run in a sandbox/VM or non-sensitive account the first time. The mermaid script may probe local paths to find a browser (including /mnt/c on WSL) — this is plausible for rendering but means the script will access your filesystem. 4) Be cautious with automatic downloads. The skill mentions downloading/inline Tailwind CSS and pulling bundled puppeteer resources; ensure those downloads come from known, trusted sources (official registries/CDNs), or pre-install required packages yourself from trusted packages before use. 5) Limit privileges and supply explicit save paths. Use the skill's feature to ask you for the exact save folder (do not accept defaults that could write into sensitive directories). Never provide credentials or secret files to the skill — none are required by design. 6) If you intend to use this routinely in an automated/always-on agent, request the source repository (SKILL.md points to a templated GitHub URL) and verify the codebase and its update process. If you cannot review the code, prefer manual invocation rather than granting it autonomous invocation in high-privilege contexts. If you want, I can: (a) highlight any network calls or filesystem accesses inside the two scripts, or (b) extract and show the SKILL.md regions containing suspicious unicode control characters for review.

Type: OpenClaw Skill Name: software-manager-skill Version: 2.2.0 The skill bundle provides a product management workflow, including PRD generation and H5 prototyping. It includes a Python script (prd_export.py) and a Node.js script (mermaid_render_multi.js) that utilize system-level execution (subprocess.run, execSync) and registry queries to locate browsers and render Mermaid diagrams. While these capabilities are plausibly necessary for the stated functionality, the use of shell execution and broad filesystem path searching across multiple platforms (Windows, macOS, Linux, WSL) constitutes a high-risk capability according to the analysis threshold. No evidence of intentional malice, data exfiltration, or unauthorized persistence was found.