prd-to-issues
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because it processes external PRD content that may contain malicious instructions.
- Ingestion points: Data enters the agent context via the
gh issue viewcommand or by reading local Markdown files (SKILL.md). - Boundary markers: The skill does not define specific delimiters or isolation instructions to prevent the agent from following instructions embedded within the PRD.
- Capability inventory: The agent has the capability to execute shell commands (
gh issue create) and write files to the local file system (under./issues/). - Sanitization: No explicit sanitization, validation, or filtering of the ingested PRD content is performed.
- Mitigation: The risk is significantly reduced by a mandatory "Quiz the user" step, where the agent must present the proposed breakdown for human approval before creating any issues.
- [COMMAND_EXECUTION]: The skill utilizes the GitHub CLI (
gh) to view and create issues. This is a legitimate functional requirement for a developer tool and uses the user's existing authenticated environment.
Audit Metadata