# Security and Privacy Considerations for PM Skills Usage > Learn about security and privacy considerations for PM Skills. Discover how Claude's sandbox ensures zero local code execution and minimal data retention for safe AI usage. - Repository: [Pawel Huryn/pm-skills](https://github.com/phuryn/pm-skills) - Tags: best-practices - Published: 2026-07-05 --- **PM Skills operates as a static markdown-based AI framework where all logic runs inside Claude's sandbox, ensuring zero local code execution, no persistent secret storage, and minimal data retention beyond the active conversation.** PM Skills is a modular "AI operating system" for product management work hosted at `phuryn/pm-skills`. Understanding the security and privacy considerations for PM Skills usage requires examining its deliberate architectural split into plugins, skills, and commands—all implemented as static markdown files rather than executable code, fundamentally limiting the attack surface. ## Architecture and Security Layers The repository’s security model relies on strict separation between data-driven skills and command workflows. Each layer lives in predictable locations with specific security boundaries. ### Plugin Structure and Isolation PM Skills organizes functionality into **installable plugins** located in `pm-/` directories (e.g., `pm-toolkit/`, `pm-product-strategy/`). Each plugin contains two critical components: - **Skills**: Static markdown knowledge bases stored in `pm-/skills/*.md` (e.g., [`pm-toolkit/skills/privacy-policy/SKILL.md`](https://github.com/phuryn/pm-skills/blob/main/pm-toolkit/skills/privacy-policy/SKILL.md)). These contain no executable code—only data-driven prompts and templates. - **Commands**: Claude-specific workflow definitions located in `pm-/commands/*.md` that chain skills together. Because plugins are pure markdown directories, users can audit every file before loading them into their environment using standard text search tools. ### Marketplace Descriptor The root [`CLAUDE.md`](https://github.com/phuryn/pm-skills/blob/main/CLAUDE.md) file serves as the canonical marketplace descriptor, pointing Claude-Code/Cowork to available plugin sets. This file contains only plugin names and metadata—no secrets, credentials, or executable configurations. ## Privacy-First Design The architecture treats personal data as transient template variables rather than persistent records. ### Data Handling in the Privacy-Policy Skill The [`pm-toolkit/skills/privacy-policy/SKILL.md`](https://github.com/phuryn/pm-skills/blob/main/pm-toolkit/skills/privacy-policy/SKILL.md) file exemplifies the non-retentive design. This skill accepts user-supplied arguments like `$PRODUCT_NAME`, `$COMPANY_NAME`, and `$INFORMATION_TYPES` to generate privacy policy text, but it never stores these values. As explicitly stated in the skill documentation: > "This is for informational purposes only and does not constitute legal advice." The skill processes these variables only during the active Claude session, generating a three-part output (summary, full policy, compliance notes) without writing data to disk or transmitting it to external services beyond Claude’s infrastructure. ### Transmission Scope The only data transmission occurs when template arguments pass to Claude during the conversation. No background data collection, telemetry, or long-term storage mechanisms exist within the repository itself. ## Security Considerations and Attack Surface The repository implements multiple safeguards to minimize security risks. ### No Secret Handling `phuryn/pm-skills` ships without API keys, tokens, or credentials. All configuration files are devoid of secrets, and the repository’s `.gitignore` explicitly prevents accidental inclusion of `.env` files or other sensitive configuration artifacts. ### Static Asset Integrity All skills are **pure markdown** description files. Unlike traditional plugin architectures that might execute Python or JavaScript, PM Skills relies entirely on Claude’s interpretation of structured markdown prompts. This means skills cannot access the file system, spawn processes, or make network requests independently. ### Claude Sandbox Isolation Commands defined in files like [`pm-product-discovery/commands/discover.md`](https://github.com/phuryn/pm-skills/blob/main/pm-product-discovery/commands/discover.md) run inside Claude’s sandboxed environment. They cannot invoke external processes, read arbitrary files on the host machine, or execute code outside the AI assistant’s controlled context. This isolation limits any potential attack surface to the Claude platform itself rather than the user’s local system. ### Auditability Because every skill is a readable markdown file, security teams can audit the entire codebase via `grep` or similar tools to verify no data collection, user tracking, or undisclosed third-party service integrations exist. The privacy-policy skill already contains built-in "Legal review required" flags and checklists for compliance verification. ## Practical Security Examples The following commands demonstrate how PM Skills processes data without exposing the system to code execution risks. ### Drafting a Privacy Policy This command uses the privacy-policy skill without executing local code: ```bash /privacy-policy PRODUCT_NAME=Acme Chat PRODUCT_URL=https://chat.acme.com COMPANY_NAME=Acme Corp COMPANY_ADDRESS=123 Main St, Anytown, USA CONTACT_EMAIL=privacy@acme.com INFORMATION_TYPES=names, emails, usage behavior, device identifiers JURISDICTION=European Union (GDPR) ``` Claude loads [`pm-toolkit/skills/privacy-policy/SKILL.md`](https://github.com/phuryn/pm-skills/blob/main/pm-toolkit/skills/privacy-policy/SKILL.md), interpolates the arguments, and returns the rendered policy without storing the supplied PII. ### Running Discovery Workflows ```bash /discover AI-powered meeting summarizer for remote teams ``` The `/discover` command (defined in [`pm-product-discovery/commands/discover.md`](https://github.com/phuryn/pm-skills/blob/main/pm-product-discovery/commands/discover.md)) chains four skills—`brainstorm-ideas`, `identify-assumptions`, `prioritize-assumptions`, and `brainstorm-experiments`—guiding the user through a complete product-discovery cycle entirely within Claude’s context. ### Generating Product Requirements ```bash /write-prd Feature: Smart notification system that reduces alert fatigue Goal: Decrease daily notification count by 30% while maintaining engagement ``` This command resolves the `create-prd` skill from [`pm-execution/skills/create-prd/SKILL.md`](https://github.com/phuryn/pm-skills/blob/main/pm-execution/skills/create-prd/SKILL.md), returning a PRD document without writing files to the local filesystem. ## Summary - **PM Skills** uses a static markdown architecture where plugins, skills, and commands contain no executable code, eliminating traditional malware vectors. - All sensitive processing occurs within **Claude’s sandbox**, preventing access to the host file system or network. - The repository contains **no secrets or credentials**, and `.gitignore` prevents accidental exposure of environment files. - Skills like [`privacy-policy/SKILL.md`](https://github.com/phuryn/pm-skills/blob/main/privacy-policy/SKILL.md) process PII as transient template variables without persistence or external transmission. - Complete **auditability** is possible through standard text search of markdown files in `pm-/` directories. ## Frequently Asked Questions ### Does PM Skills store my personal data permanently? No. PM Skills processes data only during the active Claude session. Skills like the privacy-policy template accept variables such as `$COMPANY_NAME` and `$INFORMATION_TYPES` to generate documents, but these values are not written to disk, logged tofiles, or retained after the conversation ends. The repository contains no database or storage mechanism. ### Can PM Skills execute code on my local machine? No. All skills are static markdown files located in paths like `pm-toolkit/skills/*.md`. Commands specified in `pm-/commands/*.md` are parsed by Claude and executed within the AI assistant’s sandbox. They cannot invoke shell commands, access local files beyond the repository, or spawn external processes. ### How do I verify that a PM Skills plugin is secure? Because every plugin consists of readable markdown files, you can audit the code directly by examining files in the `pm-/` directory. Search for terms like "http", "fetch", or "exec" to confirm no network calls or code execution exists. The [`CLAUDE.md`](https://github.com/phuryn/pm-skills/blob/main/CLAUDE.md) marketplace descriptor only lists plugin names, not executable code. ### Is PM Skills suitable for enterprise environments with strict compliance requirements? Yes. The architecture supports enterprise security requirements through its **static-only** asset model, **sandboxed execution**, and **zero secret storage**. Security teams can review the entire codebase offline, and the privacy-policy skill includes explicit "Legal review required" flags for jurisdiction-sensitive content like GDPR compliance.