create-prd
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Node.js script (
scripts/validate-prd.js) provided within the skill package to automate quality and structural checks on generated PRD files. - [EXTERNAL_DOWNLOADS]: The instructions guide users to install Node.js from official websites or trusted package managers (like Homebrew or nvm) if the environment is not already configured, requiring explicit user consent.
- [PROMPT_INJECTION]: The skill processes potentially untrusted user requirements and external documentation. It utilizes a strict 13-chapter template and automated validation rules to ensure the resulting output remains structurally sound and follows the intended format.
- Ingestion points: Reads content from user messages and local markdown files.
- Boundary markers: Employs markdown headers and a fixed metadata table to separate logical sections.
- Capability inventory: Capabilities include file read/write/edit and local script execution.
- Sanitization: Enforces Mermaid syntax restrictions to prevent parsing issues when handling user-provided data.
Audit Metadata