product-clarify
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns detected. The skill focuses on reviewing and promoting Product Decision Records (PDRs) within a local development environment. Its operations are limited to reading, parsing, and updating markdown documentation and metadata.
- [COMMAND_EXECUTION]: The skill executes local setup and library scripts (
setup-product-clarify.sh,pdr-lib.sh, etc.) to perform file operations, metadata parsing, and index generation. These operations are confined to the project root and do not involve network activity or privileged system access. - [DYNAMIC_EXECUTION]: A hardcoded Python snippet is used in the bash setup script to format metadata as JSON. This is a standard utility pattern for structured output and does not involve executing untrusted code or remote payloads.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided markdown files (PDRs), which could potentially contain prompt injection instructions. However, the skill acts primarily as a validator and documentation manager with limited capabilities, posing low risk. The analysis scripts use specific regex and string parsing to extract metadata fields rather than directly executing content from the files.
Audit Metadata