instrumenting-from-a-prd
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources like Linear projects, documents, and issues to build measurement plans and modify code. \n
- Ingestion points: SKILL.md (Step 1) and references/linear.md specify reading PRDs from Linear URLs, documents, and issues. \n
- Boundary markers: The skill uses specific templates (references/analytics-issue.md) and instructs the agent to "Quote, do not paraphrase" success metrics, which could include malicious instructions. \n
- Capability inventory: The skill has the ability to execute SQL queries via the PostHog MCP (references/posthog-check.md), write issues and comments to Linear (references/linear.md), and modify local source code (references/code-modes.md). \n
- Sanitization: No explicit sanitization or filtering of PRD content is described, relying on the user's manual approval process ("Write only after approval").\n- [COMMAND_EXECUTION]: The skill utilizes git and GitHub CLI commands to trace stories to specific code sections. \n
- Evidence: references/linear.md instructs using git log, git branch, and gh pr list with identifiers extracted from the PRD.\n- [EXTERNAL_DOWNLOADS]: The skill references the execution of a setup tool via npx for SDK installation. \n
- Evidence: references/code-modes.md suggests using npx @posthog/wizard to initialize the environment. This refers to the official PostHog setup utility.
Audit Metadata