to-prd
Warn
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: MEDIUMINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from the conversation history and repository content without adequate sanitization.\n
- Ingestion points: The skill takes "the current conversation context" and repository files (Step 1) as input for synthesis.\n
- Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the processed data.\n
- Capability inventory: The skill utilizes the issue tracker publication capability to export synthesized content.\n
- Sanitization: No sanitization or filtering logic is present to secure the synthesized content before publication.\n- [DATA_EXFILTRATION]: The skill is instructed to automatically publish synthesized context to an external issue tracker.\n
- Automatic Publication: Step 3 of the process in
SKILL.mddirects the agent to "publish it to the project issue tracker" immediately after the PRD is written.\n - Bypassing Review: The workflow does not require a final user approval of the synthesized text, which may lead to the unintended exposure of sensitive technical or private conversation data to potentially public or shared tracker environments.
Audit Metadata