skills/konglong87/superpm/write-prd/Gen Agent Trust Hub

write-prd

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill includes instructions to install dependent sub-skills (such as pm-demand and pm-docs) from the author's GitHub repository (github.com/konglong87/superPM) using the platform-specific npx skills add command. This is used to set up the complete workflow environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill acts as an orchestrator for processing user requirements, which represents a surface for indirect prompt injection. Malicious instructions embedded in the requirements provided by the user could theoretically attempt to influence the agent's behavior during the document generation process.
  • Ingestion points: Processes user-supplied demands and clarifications through chained sub-skills like /pm-demand and /pm-clarify.
  • Boundary markers: No specific delimiters or "ignore instructions" warnings are defined in this orchestrator file.
  • Capability inventory: The skill utilizes Bash, Write, Read, and WebSearch tools across its workflow.
  • Sanitization: No explicit sanitization or validation logic is present in the SKILL.md workflow description.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 01:16 PM