Prd Workflow

Complete PRD workflow with integrated review, flowchart, and export. Deep interview → Requirement analysis → PRD generation → Review → Flowchart → Quality ch...

What to check before installing: - Packaging mismatch: the registry claims 'instruction-only' but the bundle includes many code files and a postinstall script. Inspect scripts/postinstall.js to see exactly what it installs and whether it downloads from arbitrary URLs. - Inspect the modules that touch files and network: workflows/modules/wiki_search_module.js (wiki lookup logic), workflows/image_renderer.js / mermaid-flow (mermaid-cli usage), workflows/prototype_module.js and workflows/ai_entry.js (LLM calls). Look for any hardcoded remote endpoints, URL shorteners, or personal servers. - The skill writes interview.json and many artifacts under ~/.openclaw/workspace/output/{user}/{project}/ and persists design-system/ and .versions. If you are concerned about sensitive data, run the skill in a sandbox or container, or back up and restrict the workspace directory first. - The postinstall flow may auto-install mermaid-cli and recommend native tools (playwright, html2image) — these may pull large binaries. If you restrict installations, run postinstall manually after reviewing the script. - The interactive 'Interview me relentlessly' prompt may collect personally identifiable or sensitive business information. Consider whether you want to provide such data to an external plugin and review stored interview.json files. If you want higher confidence: request the exact contents of scripts/postinstall.js and workflows/modules/wiki_search_module.js and any network-related code; verifying those will clarify whether network downloads or external endpoints are used beyond well-known CDNs (e.g., jsdelivr for Chart.js).

Type: OpenClaw Skill Name: prd-workflow Version: 5.1.0 The skill bundle is a highly complex PRD generation workflow that integrates multiple sub-skills and utility scripts. It is classified as suspicious primarily due to the file 'skills/htmlPrototype/analyze_platform.py', which contains hardcoded credentials ('admin'/'111111') and a specific internal IP address ('10.20.181.30'), indicating it is a specialized testing tool that may not be suitable for general distribution. Furthermore, 'scripts/postinstall.js' and 'workflows/main.js' utilize 'execSync' to install packages and execute Python scripts; while 'workflows/data_bus.js' attempts to mitigate risks with path sanitization, the broad shell execution capabilities and the inclusion of environment-specific scripts with hardcoded secrets warrant caution.