The Agent Skills Directory

[SAFE]: No significant security issues were detected. The skill implements defensive measures including path sanitization via fs.realpathSync to ensure all filesystem operations are confined to the designated documentation root.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface due to its core functionality of reading project-specific markdown files (such as briefs and research documents) to inform PRD generation. This is mitigated by explicit constraints in the skill definition that forbid the agent from performing any implementation-level actions, such as editing source code or installing dependencies.
Ingestion points: Project documents like *brief*.md, *research*.md, and existing files in docs/ are read during the analysis phase.
Boundary markers: No specific delimiters or 'ignore' instructions are used for the ingested file content.
Capability inventory: Capability is restricted to writing PRD markdown files, updating a local registry file, and interacting with issue trackers.
Sanitization: Ingested content is processed as-is without explicit sanitization.
[DYNAMIC_EXECUTION]: The skill executes locally defined Python and Node.js code snippets to handle YAML configuration and document ID management. These scripts are embedded within the skill's internal references and include security hardening, such as sys.path isolation in the Python parser to prevent malicious local module shadowing.

create-prd