product-prd
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill authors product documentation by ingesting data from external sources including Jira issues, GitHub pull requests and issues, and arbitrary web URLs via the WebFetch tool. This configuration creates a potential surface for indirect prompt injection where instructions embedded in external content could attempt to influence the agent's behavior or document output.
- Ingestion points: Input enters the agent's context through the 'Discover' and 'Decide' phases, which utilize 'jira issue view', 'gh issue/pr view', 'WebFetch', and local file reads.
- Boundary markers: The workflow requires the agent to tag findings as 'CONFIRMED | INFERRED | UNKNOWN' and uses greppable tags like '[NEEDS CLARIFICATION]' to highlight gaps and assumptions, which helps separate external data from approved requirements.
- Capability inventory: The skill has the capability to modify files ('Write', 'Edit'), execute specific CLI tools via 'Bash' (git, gh, python, and uv), and delegate research to subagents using the 'Task' tool.
- Sanitization: Robust mitigations are integrated into the workflow, including a mandatory 'Authorization gate' that prevents authoring until a user explicitly approves an alignment summary. Additionally, internal scripts ('validate.py' and 'hygiene.py') automatically check for leftover placeholders, dangling links, and vague terminology before the final hand-off.
Audit Metadata