pm-ai-research
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFENO_CODEINDIRECT_PROMPT_INJECTION
Full Analysis
- [NO_CODE]: The skill is composed strictly of Markdown files containing process guidelines, templates for Product Requirements Documents (PRDs), and strategic frameworks. No shell scripts, Python files, or other executable binaries are present.
- [INDIRECT_PROMPT_INJECTION]: The skill workflow (Phase 6) instructs the agent to monitor external customer community platforms like Reddit and Hacker News. This creates an inherent surface for indirect prompt injection from untrusted web content. However, the skill treats this as a data source for synthesis rather than executable input, and no bypass instructions were detected.
- [SAFE]: The skill uses industry-standard frameworks (RICE, JTBD, Kano) and maintains a clear evidence-based operating model for product research. All external resource references are for documentation and research purposes within the defined PM scope.
Audit Metadata