prd-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The workflow involves ingesting data from the local codebase and external research agents, which could contain malicious instructions designed to influence the specification generation.\n
- Ingestion points: Feature descriptions, local codebase files, and outputs from agents such as
prd-external-researcherandprd-codebase-researcher(SKILL.md).\n - Boundary markers: The skill does not define specific delimiters or instructions to isolate external data from system prompt instructions.\n
- Capability inventory: The skill performs file writes to create specifications and executes shell commands via the
dextool (SKILL.md).\n - Sanitization: No sanitization, validation, or escaping of ingested content is performed before it is processed or written to the filesystem.\n- [DYNAMIC_CONTEXT_INJECTION]: The skill utilizes shell commands at load time to populate the header with current project context.\n
- Evidence:
!git branch --show-currentand!ls plans/are executed inSKILL.mdto display the active branch and existing plans. These commands are informational and do not access sensitive system files or credentials.
Audit Metadata