productboard
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
npx @useclawlink/clito interact with Productboard. This command execution is necessary for the skill's functionality and utilizes the vendor's own command-line interface. - [EXTERNAL_DOWNLOADS]: The skill relies on the
@useclawlink/clipackage downloaded from the official NPM registry. This package is an official resource provided by the skill author's organization. - [CREDENTIALS_UNSAFE]: The skill documentation notes that user credentials for ClawLink are stored locally at
~/.clawlink/credentials.json. This is standard behavior for CLI tools managing authentication tokens. - [INDIRECT_PROMPT_INJECTION]: As the skill retrieves and processes data from Productboard, it is subject to indirect injection risks from external content. The skill mitigates this by instructing the agent to 'confirm with the user before any write', maintaining a human-in-the-loop for sensitive operations.
Audit Metadata