to-prd
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of synthesizing untrusted data.
- Ingestion points: The skill reads the conversation context and performs repo exploration to gather data for the PRD (SKILL.md).
- Boundary markers: No specific delimiters or instructions are provided to the agent to treat ingested text as untrusted or to ignore embedded instructions within that text.
- Capability inventory: The agent is granted capabilities to read the local filesystem and write to external services.
- Sanitization: There is no evidence of content filtering or validation before the synthesized PRD is published.
- Downstream impact: The skill applies a 'ready-for-agent' label, suggesting the output is consumed by other automated tools, which could trigger a multi-step injection chain.
- [COMMAND_EXECUTION]: The skill involves executing commands that interact with external project infrastructure.
- Evidence: The process requires the agent to 'publish it to the project issue tracker' and apply triage labels, typically requiring the use of CLI tools to perform remote write operations.
Audit Metadata