context-product-manager
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from user repositories (READMEs, documentation, and source code) to generate context for downstream coding agents. This behavior presents a surface for indirect prompt injection, where malicious instructions hidden in a repository's files could attempt to influence the product plan, bypass constraints, or misdirect the behavior of agents receiving the resulting handoffs.
- Ingestion points: The
SKILL.md(Step 3) andreferences/intake-framework.md(Round 2) explicitly instruct the agent to read repository files, including READMEs, issues, and implementation files, as primary sources of truth. - Boundary markers: The skill attempts to mitigate injection risks by requiring a structured 'Canonical Context Blueprint' and a formal separation of 'Facts', 'Assumptions', and 'Unknowns' as described in
references/output-templates.mdandSKILL.mdStep 4. - Capability inventory: The skill primarily performs file reading and document generation. It does not define direct command execution or network capabilities within its own instructions.
- Sanitization: The skill mandates the creation of explicit 'Acceptance Criteria' and 'Verification Plans' for all deliverables, which serves as a review mechanism to ensure the generated plans align with the user's intent.
Audit Metadata