create-prd

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (feature descriptions) to generate a document. This represents a potential indirect injection surface if the resulting document is later processed by other automated tools. However, the skill incorporates a 'HARD-GATE' that strictly forbids the inclusion of implementation code, SQL, or technical signatures, requiring the output to remain in natural language, which significantly mitigates risks to downstream agents.
  • [SAFE]: The skill operates entirely within the local environment, writing structured Markdown files to a designated directory. No network operations, hardcoded credentials, or dynamic code execution patterns were found.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 09:25 PM
Security Audit — agent-trust-hub — create-prd