gm-prd
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources including PRD row files, dependency scan results, and CI status logs. This data is used to define 'acceptance' and 'unknowns' that direct the agent's SPECIFY, ELIMINATE, and EDIT stages.
- Ingestion points: Loads data from .gm/prd/ files and reads outputs from tools like scan_deps and ci-status.
- Boundary markers: The skill relies on the structure of the YAML rows but does not explicitly instruct the agent to ignore potentially malicious instructions embedded within the text of those rows.
- Capability inventory: The agent can execute Git operations (git_pull, git_finalize), invoke other skills (Skill), and manipulate browser state (page.evaluate).
- Sanitization: There is no evidence of sanitization or validation of the text content within the PRD rows before it is used to influence agent planning.
- [DYNAMIC_EXECUTION]: The skill employs dynamic execution patterns, specifically using 'page.evaluate' to mutate browser state and a dynamic 'Skill' invocation pattern to trigger subsequent tasks based on variable inputs like row IDs and session IDs.
- [COMMAND_EXECUTION]: The skill utilizes several tool and shell commands to manage the PRD lifecycle, including git_pull for repository synchronization, git_finalize for committing changes, and prd-add/prd-resolve for state management.
Audit Metadata