The Agent Skills Directory

[SAFE]: The skill implements a strictly defined workflow for PRD creation with mandatory human-in-the-loop checkpoints ([STOP — BLOCKING]) before major transitions. This ensures the user maintains control over the output and any downstream actions.
[SAFE]: It employs a security and quality best practice by delegating assessment to a separate sub-agent (prd-reviewer). This separation of concerns helps eliminate self-review bias and provides an independent validation step.
[SAFE]: Network activity is restricted to the WebSearch tool, which is used for the legitimate purpose of verifying technical dependencies and external service status during the drafting process.
[SAFE]: File system interaction is limited to reading project documentation from known paths (e.g., docs/product/) and writing the final PRD to a designated output directory (docs/prd/).
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection due to its ingestion of external and project-resident data.
Ingestion points: The skill reads data from user arguments, various project markdown files (hypotheses, vision, design principles), and external search engine results.
Boundary markers: The skill lacks explicit delimiters or instructions to ignore potential commands embedded within the ingested text.
Capability inventory: The skill possesses file writing capabilities and the ability to call other agent skills, which could theoretically be abused if an injection were successful.
Sanitization: There is no mention of sanitizing or escaping the content of ingested files before they are processed or used in sub-agent prompts.
Mitigation: The risk is significantly reduced by the required human review steps and the fact that the primary output is a markdown document rather than executable code.

recipe-define