common-product-requirements
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from local business requirements documents (
docs/brd/brd-[slug].md) and user-provided inputs to generate standardized documentation. - Ingestion points: Reads content from existing BRD files and interacts with users during the discovery phase.
- Boundary markers: Lacks explicit delimiters or instructions to treat ingested file content as untrusted data.
- Capability inventory: The skill's capabilities are limited to filesystem read/write operations for documentation purposes (
docs/prd/,references/). It does not have access to network tools or arbitrary command execution. - Sanitization: No specific sanitization or validation logic is applied to the text extracted from input files.
- [SAFE]: The skill adheres to best practices for documentation workflows. It uses structured templates, implements a verification checklist that includes security requirements for the product being designed, and restricts its filesystem operations to specific documentation directories.
Audit Metadata