prd-consultive
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a bundled Python script located at
scripts/embed_avatars.py. This script is used to post-process generated HTML documents by embedding local image assets as data URIs. - [EXTERNAL_DOWNLOADS]: The skill references image assets hosted on a public GitHub repository (
https://raw.githubusercontent.com/JefersonMarcioEspindola/skill-prd-consultive/...). These images provide visual avatars for the personas used in the PRD generation process. - [INDIRECT_PROMPT_INJECTION]: The skill is capable of reading project-specific metadata files (such as
package.json,requirements.txt, andREADME.md) to automatically identify the technology stack. While this is a functional feature, it represents an ingestion point for untrusted data that could potentially contain adversarial instructions. - [SAFE]: The skill implements a 'gate' mechanism, requiring explicit user confirmation before generating final documents, which ensures human-in-the-loop oversight for file creation and script execution.
Audit Metadata