Product-Manager-Skills

Least-privilege permissions

• Restrict API tokens to read-only access where possible. If connecting to Jira, Asana, or Notion, create dedicated service accounts that can only view projects and roadmaps—not delete, edit permissions, or access other teams' workspaces.
• Separate credentials by function. Use different API keys for customer feedback intake versus internal roadmap updates, so a compromised token only exposes one data stream, not everything.
• Rotate credentials monthly and immediately revoke any tokens if team members leave or if you suspect unauthorized access.
• Avoid admin-level access. The PM skill should never have "owner" or "administrator" permissions—it needs just enough access to read and organize information.

Network isolation

• Keep PM data in a dedicated, air-gapped environment if handling highly sensitive strategy (e.g., unreleased products or M&A plans). Do not feed live roadmaps into shared company Slack, email, or cloud storage that other tools can access.
• Disable external API integrations by default. Only enable connections to third-party services (GitHub, external analytics platforms) after explicit security review and only for the specific data needed.
• Use VPN or private network connections when the agent pulls from internal PM tools; avoid public internet routes for sensitive data transfer.
• Log all data flowing in and out. Route logs to a secure, audit-only storage system that the PM skill cannot modify or delete.

Monitoring

• Set alerts for unusual agent behavior: sudden large data requests, repeated failed login attempts, or queries asking for data outside the PM domain (e.g., financial records, HR data).
• Audit what the agent outputs weekly. Review a sample of responses to confirm it's only discussing product roadmaps, user feedback, and feature prioritization—not exposing customer lists, pricing, or competitive intelligence.
• Track who accesses the agent and what they ask. Maintain an audit log linking each query to a user, timestamp, and result so you can trace any information leaks back to their source.
• Monitor third-party integrations for changes. If Jira, Asana, or Notion permissions shift or new API calls appear, investigate immediately before resuming use.

Red flags to watch for

• The agent repeats or rewrites unvetted user feedback verbatim without filtering. This may indicate prompt injection—someone is embedding commands or questions into customer reviews to manipulate the agent.
• Unexpected outputs about confidential topics. If the agent suddenly discusses unreleased products, customer names, or competitive pricing without being asked, it may have been compromised or accessed unauthorized data.
• Framework updates from unmaintained sources. If the original maintainer (deanpeters) disappears, stops responding to security issues, or the repository shows no activity for 6+ months, treat the tool as potentially unsafe and plan migration.
• The agent works differently when used with non-Claude AI models. If you switch from Claude to another model and behavior changes unexpectedly (e.g., more verbose, contradictory advice, or