PRD Analyzer Skill - Execution Prompt

Context

You are executing the prd-analyzer skill. This skill analyzes a Product Requirements Document (PRD) for completeness, validates metadata, checks compliance requirements, and provides quality scores with actionable suggestions.

Inputs

• •prd_path: {{inputs.prd_path || "docs/PRD.md"}}
• •strict_mode: {{inputs.strict_mode || false}}
• •check_examples: {{inputs.check_examples || true}}

Task: Analyze PRD and Validate Quality

Step 1: Load and Parse PRD

Actions:

1. •Read the PRD file from {{inputs.prd_path}}
2. •Check file exists and is readable
3. •Parse YAML frontmatter (between --- delimiters)
4. •Extract markdown content body

Error Handling:

• •If file doesn't exist → Return {valid: false, errors: ["PRD file not found"]}
• •If YAML is invalid → Return {valid: false, errors: ["Invalid YAML frontmatter"]}

Step 2: Validate Required Metadata

Check for Required Fields:

# MUST HAVE (errors if missing):
project_name: string (non-empty)
project_type: string (healthcare|fintech|ecommerce|productivity|social|education|other)
platforms: array (at least one of: ios, android, web)

Validation Rules:

• •❌ ERROR if project_name is missing or empty
• •❌ ERROR if project_type is not from allowed values
• •❌ ERROR if platforms is empty or invalid
• •⚠️ WARNING if project_description is < 50 characters
• •⚠️ WARNING if no target_audience specified

Step 3: Validate Compliance & Security Metadata

Check Compliance Fields:

# Compliance requirements
compliance: array (e.g., ["hipaa", "pci-dss", "gdpr", "coppa", "ferpa", "soc2"])
auth_method: string (jwt|oauth2|firebase|custom)
data_encryption: string (aes-256-gcm|aes-128|none)

Validation Rules:

• •⚠️ WARNING if compliance array is empty but project_type is healthcare/fintech
• •⚠️ WARNING if auth_method is not specified
• •❌ ERROR if compliance includes "pci-dss" but no payment-related features mentioned
• •❌ ERROR if compliance includes "hipaa" but no PHI handling mentioned
• •⚠️ WARNING if data_encryption is "none" or not specified

Suggestions:

• •If healthcare → Suggest adding HIPAA compliance
• •If fintech → Suggest adding PCI-DSS + SOC2 compliance
• •If auth_method is missing → Suggest JWT or OAuth2

Step 4: Validate Content Quality

Check Markdown Content:

1. •

   Project Overview (must have):

   • •Clear description of what the app does
   • •Target audience defined
   • •Key value proposition
2. •

   Features Section (must have):

   • •At least 3 core features described
   • •Each feature should have:
     • •Name
     • •Description (> 30 words)
     • •User benefit
3. •

   Technical Requirements (should have):

   • •State management approach
   • •Architecture pattern (e.g., Clean Architecture, MVVM)
   • •Third-party services/APIs
4. •

   User Flows (nice to have):

   • •At least 1 user flow diagram or description
   • •Step-by-step user interactions

Scoring Rules:

• •Start with 100 points
• •-10 points per missing required field
• •-5 points per missing recommended field
• •-3 points per warning
• •+5 bonus points if examples are concrete and detailed
• •+5 bonus points if compliance is well-documented

Step 5: Check for Examples and Concreteness

If check_examples is true:

Validate Concrete Examples:

• •✅ GOOD: "User can schedule appointments with doctors for specific dates/times"
• •❌ BAD: "User management features"

Check for Placeholders:

• •⚠️ WARNING if PRD contains: [TBD], [TODO], {placeholder}, ...
• •⚠️ WARNING if feature descriptions are < 30 words

Step 6: Generate Analysis Report

Output Format:

{
  "valid": true | false,
  "score": 0-100,
  "errors": [
    "Missing required field: project_name",
    "Invalid project_type: must be one of [healthcare, fintech, ...]"
  ],
  "warnings": [
    "No compliance requirements specified (recommended for healthcare apps)",
    "Feature descriptions are too brief (< 30 words)"
  ],
  "suggestions": [
    "Add HIPAA compliance requirements for healthcare app",
    "Specify authentication method (recommend JWT or OAuth2)",
    "Add concrete examples for each feature",
    "Define user flows for core features"
  ],
  "metadata": {
    "project_name": "HealthApp",
    "project_type": "healthcare",
    "platforms": ["ios", "android"],
    "compliance": ["hipaa", "gdpr"],
    "features_count": 8,
    "has_examples": true,
    "completeness": 85
  },
  "sections": {
    "overview": "complete",
    "features": "complete",
    "technical": "partial",
    "user_flows": "missing"
  }
}

Step 7: Apply Strict Mode (if enabled)

If strict_mode is true:

• •Convert all warnings to errors
• •Set valid = false if any warnings exist
• •Return immediately without suggestions

Quality Grading Scale

Special Compliance Checks

HIPAA (Healthcare)

• •✅ Must mention: PHI encryption, audit logging, access controls
• •⚠️ Should mention: Session timeouts, role-based access, BAA requirements

PCI-DSS (Finance)

• •✅ Must mention: NO storage of full card numbers, tokenization, payment provider
• •❌ ERROR if PRD suggests storing payment card data directly

GDPR (Privacy)

• •✅ Must mention: User data export, right to deletion, consent management
• •⚠️ Should mention: Cookie consent, privacy policy, data retention

Example Output (Healthcare App)

{
  "valid": true,
  "score": 88,
  "errors": [],
  "warnings": [
    "No data retention policy specified (required for HIPAA)",
    "Missing user flow for appointment booking"
  ],
  "suggestions": [
    "Add data retention policy (recommend 7 years for medical records)",
    "Define user flow: Login → View Doctors → Select Date → Confirm Appointment",
    "Add audit logging requirements for PHI access"
  ],
  "metadata": {
    "project_name": "HealthConnect",
    "project_type": "healthcare",
    "platforms": ["ios", "android"],
    "compliance": ["hipaa", "gdpr"],
    "auth_method": "jwt",
    "data_encryption": "aes-256-gcm",
    "features_count": 12,
    "has_examples": true,
    "completeness": 88
  },
  "sections": {
    "overview": "complete",
    "features": "complete",
    "technical": "complete",
    "user_flows": "partial",
    "compliance": "complete",
    "security": "complete"
  }
}

Success Criteria

Skill succeeds if:

1. •PRD file exists and is parseable
2. •All required metadata fields are present
3. •No critical errors found
4. •Score >= 60 (passing grade)

Skill fails if: 5. PRD file not found 6. Invalid YAML syntax 7. Missing critical metadata (project_name, platforms) 8. Score < 60 or errors.length > 0

Next Steps Recommendation

Based on score:

• •90-100: Proceed to prprompts-generator skill immediately
• •80-89: Proceed, but consider addressing warnings
• •70-79: Address major issues before generating PRPROMPTS
• •< 70: Fix errors and run prd-analyzer again before proceeding