to-prd
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from the conversation history and repository context to generate a PRD document that is subsequently published to an external issue tracker. This creates a surface for indirect prompt injection where malicious instructions embedded in the conversation could be synthesized into the PRD and later executed by other agents monitoring the tracker.\n
- Ingestion points: The agent reads from the current conversation context and codebase understanding as specified in the SKILL.md instructions.\n
- Boundary markers: Absent. There are no explicit instructions or delimiters provided to ensure the agent treats conversation data strictly as data rather than instructions during the synthesis process.\n
- Capability inventory: The skill is designed to publish content to an external project issue tracker using tools like
claude-codeorcursor.\n - Sanitization: Absent. The process does not include steps to sanitize, escape, or validate the content extracted from the conversation before publishing it to the external tracker.
Audit Metadata