prd-generator

SUSPICIOUS: the core PRD-generation behavior is aligned with its purpose, and there is no external installer or obvious credential harvesting. However, the mandatory automatic commit/push without per-action approval is disproportionate and creates significant risk of unintended remote publication; optional execution of a repo-local script adds secondary trust risk.