skills/sadiksaifi/skills/prd-write/Gen Agent Trust Hub

prd-write

Pass

Audited by Gen Agent Trust Hub on Mar 19, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the GitHub CLI (gh) via Bash to list repository metadata (labels, milestones) and create issues. These operations are fundamental to the skill's primary purpose and are implemented using safe shell patterns, such as quoted heredocs, to prevent potential command injection from the generated PRD content.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates external research through WebSearch and WebFetch tools to provide domain context and technical documentation. These actions are limited to information gathering for documentation purposes.
  • [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes data from the local codebase and external websites to generate summaries.
  • Ingestion points: Codebase files via Glob, Grep, and Read, plus external content via WebFetch in SKILL.md.
  • Boundary markers: No explicit delimiters are specified for wrapping ingested code or web content during processing.
  • Capability inventory: Execution of gh CLI commands and spawning of Agent subagents for exploration.
  • Sanitization: Ingested content is summarized and presented to the user for review before being used to create an issue, providing a human-in-the-loop safety check.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 19, 2026, 07:54 PM