to-prd

Pass

Audited by Gen Agent Trust Hub on Jun 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses standard shell commands (ls, find, grep) to explore the codebase for domain context and existing test patterns. These are read-only operations restricted to the project directory.
  • [COMMAND_EXECUTION]: It utilizes the GitHub CLI (gh issue create) to publish the generated PRD. This is an expected behavior based on the skill's description and requires the user to have the CLI authenticated and the publish argument explicitly provided.
  • [EXTERNAL_DOWNLOADS]: While the skill interacts with GitHub to create issues, it does not download or execute external scripts or packages from untrusted sources. The use of the official GitHub CLI is a well-known and standard practice for developer tools.
  • [DATA_EXFILTRATION]: No sensitive data (credentials, SSH keys, or environment secrets) is accessed or transmitted. The information sent to GitHub consists of the synthesized PRD content derived from the active conversation and public codebase structure.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 20, 2026, 05:00 PM
Security Audit — agent-trust-hub — to-prd