product-analyze
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local setup scripts (
setup-product-analyze.shandsetup-product-analyze.ps1) which use standard system tools likegitandfindto inventory repository artifacts. - [DYNAMIC_EXECUTION]: A bash setup script includes an inline Python heredoc to serialize project metadata into JSON format. This is a benign utility pattern used for structured data output.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze user-controlled markdown documentation (PRDs and PDRs). While this constitutes an untrusted data surface, the skill's strictly read-only mode and its primary function as a static analysis tool make this behavior standard and expected.
- [EXTERNAL_DOWNLOADS]: The documentation references a dependency on the
architect-clarifyskill for Mermaid diagram validation. This is a local inter-skill dependency within the same vendor's (tikalk) suite and requires manual installation by the user, representing a modular tool architecture rather than a hidden remote download.
Audit Metadata