prd-to-goal
Warn
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's primary function is to generate shell command chains (e.g.,
test -f ... AND pnpm test ...) for the agent to execute in a loop. Maliciously crafted input documentation could influence the generation of these commands. \n- [REMOTE_CODE_EXECUTION]: Section 8 ('Post-timeout assertion grader') details a pattern for spawning a fresh subagent by executing a shell command:claude -p --bare \"$(cat /tmp/grader-prompt.txt)\". This dynamic process invocation is a powerful primitive that could be abused if the prompt file content is compromised. \n- [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because it parses untrusted external data (GitHub issues, PRD files, pasted text) and directly transforms that information into executable logic. \n - Ingestion points:
gh issue viewcalls and local fileReadoperations inSKILL.mdSection 2. \n - Capability inventory:
Bash,Write,Grep,Agenttools. \n - Sanitization: The instructions lack guidance on sanitizing or escaping content from the source documents before interpolating it into shell commands. \n
- Boundary markers: No explicit delimiters are used to separate the source text from the generation logic, increasing the risk that embedded instructions in the PRD will be followed literally by the agent.
Audit Metadata