to-prd
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the GitHub (
gh) and GitLab (glab) CLI tools to create issues. While these are standard tools, the content for the issue titles and bodies is derived from synthesized conversation context, which could potentially be manipulated by an attacker to influence the command's behavior. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the current conversation and the repository (Glossary, ADRs, existing code). This data is used to generate the PRD content.
- Ingestion points: Conversation context, domain glossary files, and Architecture Decision Records (ADRs) within the local repository.
- Boundary markers: The skill uses markdown headers and specific template tags (e.g.,
<prd-template>) to structure the output, but lacks explicit instructions to ignore embedded commands within the ingested data. - Capability inventory: The agent can write files to the local
.scratch/directory and execute shell commands viaghandglabto create remote issues. - Sanitization: There is no evidence of sanitization or escaping of the synthesized content before it is passed to the CLI tools or written to the local file system.
Audit Metadata