The Agent Skills Directory

[SAFE]: No critical or high-risk security issues were detected. The skill performs its stated purpose of PRD generation using standard tools.
[EXTERNAL_DOWNLOADS]: The skill fetches technical documentation and market research from well-known platforms (Firecrawl, Context7, and Supabase) to inform the PRD generation process.
[COMMAND_EXECUTION]: Utilizes standard filesystem search tools (glob and grep) to map project architecture and database schemas, which is a core part of its technical feasibility analysis.
[DATA_EXFILTRATION]: There are no signs of unauthorized data transmission. The skill analyzes project metadata but avoids sensitive files such as credentials, environment variables, or private keys.
[PROMPT_INJECTION]: A potential surface for indirect prompt injection exists because the skill ingests content from external websites via Firecrawl research. However, because the output is a static documentation file (PRD) for user review, the risk is considered low.
Ingestion points: Web scraping output from Firecrawl in SKILL.md (Step 1a).
Boundary markers: Absent; scraped content is integrated directly into the research summaries.
Capability inventory: The skill has the ability to write markdown files to the local tasks/ directory.
Sanitization: No explicit sanitization of external input before its inclusion in the generated document.

design-prd