tlc-prd
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary function is text-based interviewing and local markdown file generation. It does not request access to network tools, sensitive credentials, or shell execution capabilities.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input during the interview process to populate a PRD template. This is a standard operation for this type of tool.
- Ingestion points: User responses during the dialogue (e.g., describing a situation or problem).
- Boundary markers: The agent is instructed to use a specific template from
references/document-format.mdand output markdown. - Capability inventory: Local file writing (creating
.prd/<slug>.md). There are no capabilities for network access, code execution, or subprocess management. - Sanitization: No explicit sanitization or escaping of user input is mentioned, as the input is treated as descriptive prose for a document.
- [DATA_EXFILTRATION]: The skill explicitly includes a rule stating that the file is the only output and should not be published, uploaded, or synced to any external service. No network-capable tools are used.
Audit Metadata