prd-start
Pass
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute a local Python script (
prd-command-dispatch.py) located within the skill's directory structure. This is used to initiate the PRD (Product Requirements Document) helper process. - [PROMPT_INJECTION]: A surface for indirect prompt injection exists because the skill processes content from the current project directory.
- Ingestion points: Untrusted data enters the agent context via the
--project .argument inSKILL.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded instructions are present in the command string.
- Capability inventory: The skill is permitted to use the
Bashtool, which is used to launch the Python-based dispatcher. - Sanitization: No evidence of content sanitization or validation is visible in the skill's instructional prompt.
Audit Metadata