deliver-prd

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: Instruction analysis: The skill implements a PRD authoring process. Step 8 (Agent Execution Contract) acts as a security control by defining boundaries (Do Not Touch) and authoritative sources for downstream automated processes.\n- [SAFE]: Persistence and Data Handling: The skill uses .claude/pm-skills.local.md for context persistence. The instructions mandate user confirmation before writing (memory_auto_append: false by default), preventing silent state manipulation.\n- [SAFE]: Metadata and External Resources: All project links point to the product-on-purpose GitHub organization. No obfuscated code, hidden instructions, or credential leakage patterns were identified in SKILL.md, TEMPLATE.md, or EXAMPLE.md.\n- [SAFE]: Security Posture: The skill includes specific instructions for validating AI behavior (AB-n scheme), which focuses on refusal and access control (AB-5), demonstrating an integrated approach to AI safety.\n- [SAFE]: Indirect Prompt Injection: The skill processes user-defined feature requirements and external research (interpretation artifacts). While this constitutes an ingestion surface, the skill mitigates risks through the 'Agent Execution Contract' which establishes a verification map for all functional requirements (FR-n).
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 12:05 PM