Prd Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:54 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed PRD generator, but it automatically saves files and starts downstream development workflow steps without an explicit confirmation gate.

Install only if you want a PRD skill that can continue into an automated development pipeline. Review generated PRDs before allowing downstream implementation, and ensure your agent asks before writing PRDs to disk or sending them to other skills or sessions, especially if requirements contain sensitive business details.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:43

Finding

Automatic Downstream Skill Invocation and Cross-Session Coordination Without User Confirmation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43-45 and 62-75
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Vulnerable Code

markdown

### 3. Output Format
The PRD is generated in markdown format with clear section headers and structured content. After generating the PRD, the skill automatically triggers the dev-skill to begin implementation.

markdown

## Auto-Trigger Next Steps

After generating the PRD, this skill automatically:
1. Saves the PRD to `prd-output/` directory with timestamp
2. Triggers `dev-skill` with the PRD as input
3. Monitors the pipeline progress through session messaging

## Integration with Auto-Dev-Pipeline

This skill is designed to work seamlessly with:
- **dev-skill**: Receives PRD and generates SwiftUI code
- **qa-skill**: Receives code and generates test cases
- **session coordination**: Uses `sessions_send` to trigger next steps

Technical Analysis

The declared primary purpose of the skill is to transform natural-language requirements into a Product Requirements Document. However, the instructions expand execution beyond document generation by directing the agent to write the result to disk, invoke another skill automatically, and coordinate activity through cross-session messaging.

No explicit user-confirmation checkpoint, destination validation, downstream content validation, or approved-session restriction is specified. Consequently, user-controlled requirements incorporated into the generated PRD may be forwarded to another agent or skill as operational input. This creates an instruction-propagation boundary in which a documentation request can transition automatically into implementation activity.

The audited package contains only SKILL.md; no executable scripts or direct implementation of sessions_send were present. Exploitability and final impact therefore depend on whether the hosting agent grants ...[truncated 1510 chars]

Remediation

View remediation

Remediation Suggestions

1. Make PRD generation the default terminal action. Return the generated document to the user without automatically starting implementation.
2. Require explicit, informed user confirmation before each side effect:
   • Writing the PRD to disk.
   • Invoking dev-skill or qa-skill.
   • Sending messages to another session.
3. Display the exact output path, destination skill, session identifier, and content summary before requesting approval.
4. Treat generated PRD content as untrusted data. Use a structured schema and prevent free-form PRD text from being interpreted as agent-control instructions.
5. Validate and normalize the output path, confining writes to a dedicated approved directory and rejecting path traversal or unsafe filenames.
6. Restrict session messaging to explicitly approved session identifiers and apply least-privilege controls to downstream tools.
7. Add a review gate between PRD generation and implementation so users can edit or reject generated requirements before they are forwarded.
8. Record downstream invocations and filesystem writes in an audit log, including the initiating user approval and destination.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly states it will save generated PRDs to disk and automatically trigger downstream skills, but it provides no user notification, consent checkpoint, or confirmation boundary before these side effects occur. In an agent pipeline, this can cause unintended persistence of potentially sensitive requirements and unauthorized chaining into code-generation actions, increasing the chance of data leakage, unwanted execution, or user-surprising behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The example user input is in Chinese, while the rest of the skill documentation is in English, but the skill does not state whether outputs will follow the user's language or default to a specific locale. This can create an implicit language-policy ambiguity without user opt-in or documented behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.