create-second-brain-prd
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an ingestion surface for untrusted data by instructing the agent to read user-provided requirement files and perform external web research on various APIs and platforms.\n
- Ingestion points: The workflow involves reading a requirements template (at path
$0) and retrieving live information via web research in Step 3.\n - Boundary markers: The design explicitly mandates the use of XML trust boundaries (
<external_data>) paired with specific system prompt instructions to distinguish data from instructions.\n - Capability inventory: The resulting system uses the Claude Agent SDK with capabilities including file read/write, bash execution, and network requests via Python scripts.\n
- Sanitization: The skill describes a three-layer defense strategy (pattern detection, escaping, and XML boundaries) and includes a 'pre-flight guardrail agent' to evaluate external data before it is processed by the main reasoning engine.\n- [COMMAND_EXECUTION]: The generated PRD instructs the agent to create and execute scripts that use Bash for automation. To mitigate risk, the skill requires implementing a command guard (
block-secrets.py) that filters dangerous patterns and recursively checks subshell commands for malicious intent.\n- [EXTERNAL_DOWNLOADS]: The system architecture described by the skill relies on standard, well-known software libraries and APIs, such as FastEmbed, sqlite-vec, and official platform SDKs (e.g., Google and Slack). The skill directs the agent to research these dependencies to ensure correct and secure implementation.
Audit Metadata