issue-to-prd
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill reads external, untrusted content from GitHub issue bodies and comments in 'stages/01-read-issue/CONTEXT.md' and processes this data in subsequent analysis stages without sanitization or boundary markers. A malicious actor could craft an issue containing instructions to manipulate the agent's behavior during the PRD generation process.
- Ingestion points: GitHub issue body and comments fetched via 'gh issue view' in 'stages/01-read-issue/CONTEXT.md'.
- Boundary markers: Absent. The skill does not use delimiters or instructions to isolate untrusted external input from the agent's internal logic.
- Capability inventory: File reading via 'Read' tool in 'stages/02-context-completeness/CONTEXT.md'; issue modification and commenting via 'gh' CLI tool in stages 06 and 07.
- Sanitization: Absent. Data from the issue is directly analyzed and incorporated into the final PRD output.
- [DATA_EXFILTRATION]: Potential Data Exposure. In 'stages/02-context-completeness/CONTEXT.md', the agent is instructed to read source files referenced in the issue. Combined with the lack of input isolation, an attacker could use this to reference sensitive files such as '.env' or credential files, which the agent might then read and publish to the issue body in 'stages/07-publish/CONTEXT.md', leading to unauthorized data exposure.
Audit Metadata