create-prd
Pass
Audited by Gen Agent Trust Hub on Jun 3, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill operates as a structured text generation tool. It processes user-supplied business context to produce markdown documentation across 14 predefined chapters, following a logic-based sequence defined in SKILL.md.
- [COMMAND_EXECUTION]: The repository includes administrative Python scripts (
scripts/install_skill.pyandscripts/build.py). These scripts perform standard local file operations, such as copying files to the~/.claude/skills/directory for installation and concatenating markdown files into a single distribution prompt. These are legitimate development and deployment tools with no malicious behavior identified. - [DATA_EXPOSURE]: No hardcoded credentials, API keys, or sensitive environment variable access was found. The skill instructions focus entirely on the transformation of business requirements into structured PRD content.
- [REMOTE_CODE_EXECUTION]: There are no patterns suggesting the download or execution of remote scripts. Dependencies used in the Python scripts are restricted to the standard library (
os,re,shutil,pathlib).
Audit Metadata