prd-update-progress
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands such as
git log,git diff,git add ., andgit commit. These are used appropriately within the defined scope of analyzing development progress and documenting it within the repository. - [DATA_EXFILTRATION]: While the skill reads git history and files within the
prds/directory, it does not perform any network operations to send this data externally. All operations are confined to the local project environment. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from git commit messages and PRD file content. This constitutes a potential injection surface; however, the skill explicitly includes a 'User Confirmation Process' (Step 6) that requires human oversight before any updates are applied or committed, significantly mitigating the risk of the agent following instructions embedded in commit messages.
Audit Metadata