design-prd — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited design-prd (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create detailed, actionable Product Requirements Documents through structured conversation, informed by codebase analysis and competitive research.
Before writing any PRD, understand the project from its source code.
Read package.json (or equivalent) to extract:
Glob: **/app/**/page.tsx → Next.js routes (features)
Glob: **/features/*/ → Feature directories
Glob: **/src/routes/**/*.tsx → Route-based features
Grep: pattern "export default" glob "**/page.tsx" output_mode "files_with_matches"Read feature READMEs if they exist:
Glob: **/*README*.md → Feature docs
Glob: **/docs/*.md → DocumentationGlob: **/supabase/migrations/*.sql → SQL migrations
Glob: **/prisma/schema.prisma → Prisma schema
Glob: **/drizzle/schema.ts → Drizzle schema
Glob: **/types/*.ts → TypeScript type definitionsGlob: **/tasks/prd-*.md → Existing PRDs
Glob: **/docs/prd-*.md → Existing PRDs (alt location)
Glob: **/specs/*.md → Spec documentsPROJECT CONTEXT:
- Framework: [name + version]
- Database: [type + ORM]
- Existing features: [list of routes/feature dirs]
- Existing PRDs: [list or none]
- Data entities: [list from schema]
- Auth system: [provider]When the user describes a feature, research how others have solved it:
CallMcpTool(server: "user-firecrawl", toolName: "firecrawl_search", arguments: {
"query": "<FEATURE_TYPE> UX patterns best practices [current year]",
"limit": 5,
"sources": [{ "type": "web" }]
})Additional searches based on feature type:
| Feature Type | Search Query |
|---|---|
| CRUD / data management | <domain> management app UX best practices |
| Dashboard / analytics | dashboard design patterns data visualization best practices |
| Authentication / onboarding | user onboarding flow best practices [current year] |
| E-commerce / payments | e-commerce checkout UX optimization [current year] |
| Social / community | social features community engagement UX patterns |
| Content / CMS | content management UX editing experience best practices |
| Search / filtering | search and filter UX patterns faceted search |
| Settings / preferences | settings page UX patterns user preferences |
Scrape the most relevant result for detailed patterns:
CallMcpTool(server: "user-firecrawl", toolName: "firecrawl_scrape", arguments: {
"url": "<BEST_RESULT_URL>",
"formats": ["markdown"],
"onlyMainContent": true
})Check if the framework supports what the feature needs:
CallMcpTool(server: "context7", toolName: "resolve-library-id", arguments: {
"libraryName": "<FRAMEWORK>",
"query": "<FEATURE_CAPABILITY> support"
})CallMcpTool(server: "context7", toolName: "query-docs", arguments: {
"libraryId": "<RESOLVED_ID>",
"query": "<FEATURE_CAPABILITY> implementation guide"
})If the feature involves data, check the existing schema:
CallMcpTool(server: "plugin-supabase-supabase", toolName: "list_tables", arguments: {
"project_id": "<PROJECT_ID>",
"schemas": ["public"],
"verbose": true
})Or for specific tables:
CallMcpTool(server: "plugin-supabase-supabase", toolName: "execute_sql", arguments: {
"project_id": "<PROJECT_ID>",
"query": "SELECT column_name, data_type, is_nullable FROM information_schema.columns WHERE table_name = '<RELEVANT_TABLE>' ORDER BY ordinal_position"
})Determine:
When the user describes a feature, DO NOT start writing immediately.
Identify what is clear vs unclear:
SemanticSearch: "How does the app currently handle <FEATURE_AREA>?" target: []
Grep: pattern "<FEATURE_KEYWORDS>" glob "*.{ts,tsx,js,jsx}"If similar functionality already exists, the PRD should extend it rather than duplicate.
| Category | Ask When... |
|---|---|
| Problem / Goal | The "why" is unclear |
| Core Functionality | The "what" is vague |
| Scope Boundaries | Request is broad |
| Target User | Multiple user types possible |
| Success Criteria | No clear definition of "done" |
Before I write the PRD, a few questions:
1. What is the primary goal?
A. Improve UX for existing workflow
B. Add net-new capability
C. Fix a pain point
D. Performance improvement
2. Who is the target user?
A. Power users (daily use)
B. New users (onboarding)
C. All users equally
D. Internal / admin users
3. What is the expected scope?
A. MVP (ship fast, iterate later)
B. Complete feature with polish
C. Foundation for larger system
Reply with selections (e.g., "1B, 2A, 3B")# PRD: [Feature Name]
> **Status:** Draft
> **Created:** [Date]
> **Author:** [User] + AI co-author
---
## 1. Overview
[2-3 sentences: what this does and why it matters]
### Problem Statement
[Pain point or opportunity being addressed]
### Proposed Solution
[High-level description]
---
## 2. Goals
| Goal | Success Metric |
|------|----------------|
| [Goal 1] | [Measurable outcome] |
| [Goal 2] | [Measurable outcome] |
---
## 3. User Stories
### Primary Stories
1. As a [user], I want to [action] so that [benefit]
2. As a [user], I want to [action] so that [benefit]
### Edge Case Stories
3. As a [user], when [unusual condition], I expect [graceful behavior]
---
## 4. Functional Requirements
### Must Have (P0)
- [ ] FR-1: [Requirement]
- [ ] FR-2: [Requirement]
### Should Have (P1)
- [ ] FR-3: [Requirement]
### Nice to Have (P2)
- [ ] FR-4: [Requirement]
---
## 5. Non-Goals (Out of Scope)
- [Thing NOT doing and why]
- [Another thing NOT doing and why]
---
## 6. Technical Feasibility
### Existing Infrastructure
- **Framework:** [detected — supports feature because...]
- **Database:** [existing tables that support this: ...]
- **Auth:** [current auth supports required permissions: YES/NO]
### New Infrastructure Needed
- **Database changes:** [new tables, columns, or migrations]
- **API endpoints:** [new routes needed]
- **New dependencies:** [libraries to add, if any]
### Complexity Assessment
| Component | Complexity | Estimate | Notes |
|-----------|-----------|----------|-------|
| Frontend UI | [Low/Med/High] | [days] | [notes] |
| API layer | [Low/Med/High] | [days] | [notes] |
| Database | [Low/Med/High] | [days] | [notes] |
| Auth/permissions | [Low/Med/High] | [days] | [notes] |
---
## 7. Competitive Analysis
### How Others Solve This
[Summary from Firecrawl research]
| Product | Approach | Strength | Weakness |
|---------|----------|----------|----------|
| [Competitor A] | [how they do it] | [what works] | [what doesn't] |
| [Competitor B] | [how they do it] | [what works] | [what doesn't] |
### Our Differentiation
[What we will do differently and why]
---
## 8. UI/UX Considerations
### Key Screens
1. [Screen name] — [purpose]
2. [Screen name] — [purpose]
### UX Patterns Borrowed
- [Pattern from research] — adapted for [our context]
### Accessibility Requirements
- Keyboard navigable
- Screen reader compatible
- Color contrast WCAG AA
---
## 9. Data Model
### Existing Tables Used
| Table | Columns Used | Purpose |
|-------|-------------|---------|
| [table] | [columns] | [why needed] |
### New Tables / Changes-- New table or ALTER TABLE CREATE TABLE IF NOT EXISTS [table_name] ( id uuid PRIMARY KEY DEFAULT gen_random_uuid(), [columns...], created_at timestamptz NOT NULL DEFAULT now(), updated_at timestamptz NOT NULL DEFAULT now() );
### RLS Policies Needed
- [Policy description]
---
## 10. Open Questions
- [ ] Q1: [Unresolved question]
- [ ] Q2: [Unresolved question]After presenting the PRD:
Location: tasks/prd-[feature-name].md
Naming:
prd-dark-mode.md, prd-export-csv.md, prd-user-onboarding.mdTarget audience: a junior developer should understand this.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.