The Agent Skills Directory

[SAFE]: The skill implements a structured workflow for generating product planning artifacts under the .hyper/prd/ directory. It uses bundled Node.js/Bun scripts for local data processing and visualization without involving untrusted remote resources.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied ideas and live research data to generate markdown documentation and HTML previews. This data ingestion represents a surface for indirect prompt injection, where malicious instructions in external content could attempt to influence the agent's behavior during document creation.
Ingestion points: User briefs and results from live web research (specified in SKILL.md and rules/package-workflow.md).
Boundary markers: The provided templates in the assets/ directory do not utilize specific delimiters to isolate potentially untrusted content from research results.
Capability inventory: The skill requires file-system access for reading and writing artifacts, along with the ability to execute the bundled .mjs scripts.
Sanitization: The scripts scripts/build-preview.mjs and scripts/render-planning-map.mjs include manual HTML entity escaping to mitigate potential cross-site scripting (XSS) in the generated preview.html and diagram.svg files.

prd-maker