product-requirements-builder — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited product-requirements-builder (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Help users create professional, implementation-ready product requirements. The output is a PRD (the "what" and "why") plus a set of focused RFCs (the "how"), designed so that a coding agent can pick up any single RFC and implement it with minimal hallucination.
A PRD without RFCs is too vague for implementation. RFCs without a PRD lack product context and user grounding. The combination gives coding agents:
Copy this checklist and track progress:
Requirements Progress:
- [ ] Phase 1: Discovery — understand the product vision
- [ ] Phase 2: PRD Draft — write the product requirements document
- [ ] Phase 3: RFC Breakdown — identify implementation areas
- [ ] Phase 4: RFC Drafting — write each RFC
- [ ] Phase 5: Review — validate completeness and consistency
- [ ] Phase 6: Generate Prompt — create implementation prompts for coding agentsSave all documents in a Product requirements/ directory at the project root. Ask the user if they prefer a different location. If a directory already exists with PRDs or RFCs, use that location instead.
Naming convention:
| Document | Filename |
|---|---|
| PRD | PRD-[ProjectName].md |
| Architecture RFC | RFC-000-architecture.md |
| Feature RFCs | RFC-[NNN]-[slug].md (e.g., RFC-003-voice-capture.md) |
001, 002, 012Before asking questions, read the existing codebase if one exists. Scan the project directory for:
Product requirements/, docs/, specs/,or rfcs/ directory)
This context prevents you from producing specs that conflict with the codebase. If a PRD already exists and the user wants to add a feature, skip to Phase 3 (see "Adding an RFC to an existing project" below).
Now interview the user. Adapt your questions to what the codebase and user have already told you — don't re-ask what's obvious from context.
Core questions (ask what's missing, skip what's known):
Capture answers in your working memory. You'll weave them into the PRD.
#### Adding an RFC to an existing project
If the project already has a PRD and the user wants to add a feature (not start from scratch):
data models, glossary, and conventions
existing RFCs
Use the PRD template. See templates/prd-template.md for the full template with section guidance.
Key sections (every PRD needs these):
Writing principles:
Decompose the product into discrete, implementable RFCs. Each RFC should:
Common decomposition pattern:
| RFC | Area | Typical Content |
|---|---|---|
| RFC-000 | Architecture Overview | User flows, state management, service architecture, performance targets |
| RFC-001 | Database & Data Models | Schema, ORM models, migrations, sync strategy, RLS policies |
| RFC-002 | Core Feature A | The primary user-facing capability |
| RFC-003 | Core Feature B | Secondary capability |
| RFC-004 | Integration / API | External service integration, edge functions |
| RFC-005 | UI Components | Screens, navigation, state management, accessibility |
Adapt this to the project. A simple web app might need 3 RFCs. A cross-platform mobile app might need 6+. Always start with RFC-000 as the architecture overview that all other RFCs reference.
Implementation order: After defining all RFCs, determine the order they should be implemented. List them with a one-line justification:
Implementation Order:
1. RFC-000: Architecture — foundation everything else depends on
2. RFC-001: Database & Models — data layer must exist before features
3. RFC-002: Core Feature A — primary user value, validates the architecture
4. RFC-004: API Integration — needed by Feature B
5. RFC-003: Feature B — depends on API integration
6. RFC-005: UI Polish — requires all features to be functionalInclude this in the PRD's "Features Overview" section so the implementation agent knows what to build first.
Use the RFC template. See templates/rfc-template.md for the full template with section guidance.
Each RFC must include:
Writing principles for RFCs:
src/database/schema.ts).Before finalizing, actively verify each item — don't just eyeball it.
search the RFC files to confirm at least one RFC references it. List any orphaned stories.
across the PRD and every RFC that references them. Flag any mismatches (e.g., PRD says categoryId: UUID but RFC-003 says category: String).
Flag any capability that appears in more than one RFC's "This RFC covers" list.
section with cross-references to sibling RFCs.
all RFC files for variant spellings or synonyms (e.g., "Note" vs "Idea", "Category" vs "Folder"). Fix inconsistencies.
(not empty or placeholder). Check that error/failure scenarios are addressed, not just happy paths.
and libraries declared in the PRD's Technology Stack table.
fast") with acceptable ranges.
Present the review results to the user as a checklist with pass/fail for each item and details on anything that needs fixing.
After all RFCs are reviewed and finalized, ask the user:
"Would you like me to generate a complete implementation prompt for any of these RFCs? You can paste it into a new Claude Code session to implement the feature."
If the user says yes, ask which RFC(s) they want a prompt for (or offer to do all of them).
For large projects (3+ RFCs, parallel implementation): generate a full orchestration prompt instead of per-RFC prompts. An orchestration prompt assigns the agent an orchestrator role: it defines phases, spawns one sub-agent per RFC, verifies integration between phases, and never writes code directly. Use the orchestrator skill to execute this kind of prompt. Mention this option to the user when the implementation scope warrants it.
To generate the prompt, you must:
a. Opening context — tell the agent what RFC to implement and where to find it (absolute path)
b. Files to read first — list every existing file the agent should read before writing code:
c. Step-by-step implementation plan — ordered steps with:
d. Project conventions — any patterns the agent must follow:
What makes a good implementation prompt:
tasks/todo.md first and mark items as it goesSee references/example-prompt-patterns.md for simpler prompt patterns that can be used as building blocks.
Small project (landing page, simple tool, single-platform app):
Medium project (multi-feature app, API + frontend):
Large project (cross-platform, multiple integrations, team of developers):
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.