shard-prd
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the 'md-tree' utility and Node.js for file processing. It performs a security check to ensure that all sharding operations remain within the designated 'PRD_ROOT' directory, preventing unauthorized file system access.
- [DYNAMIC_EXECUTION]: Validation logic is executed using 'node -e' which loads a local utility script ('doc-id.js'). This mechanism is used to verify document types and numbering before any file modifications occur.
- [INDIRECT_PROMPT_INJECTION]: The skill shards untrusted user-provided PRD content based on markdown headers. Ingestion point: PRD content. Boundary markers: Instruction to maintain content integrity. Capability inventory: 'md-tree' execution and file writing. Sanitization: Filename normalization. This surface is a low-risk inherent property of markdown processing tools.
- [EXTERNAL_DOWNLOADS]: The skill documentation recommends the installation of '@kayvan/markdown-tree-parser' from the official NPM registry to automate the document sharding process.
Audit Metadata