Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/ihudak/ihudak-claude-plugins/create-prdgit clone --depth 1 https://github.com/ihudak/ihudak-claude-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/ihudak/ihudak-claude-plugins/create-prd)<a href="https://agentmods.dev/commands/ihudak/ihudak-claude-plugins/create-prd"><img src="https://agentmods.dev/badge/commands/ihudak/ihudak-claude-plugins/create-prd.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.17884 |
| Opus 5 | $0.00000 | $0.08942 |
| Sonnet 5 | $0.00000 | $0.03577 |
| Haiku 4.5 | $0.00000 | $0.01788 |
Grade A, and why
create-prd scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 665 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Author a Product Requirements Document: $ARGUMENTS
/create-prd is sub-project 2 of the PRD-creation flow (PM phase) — it consumes the idea.md from
/idea and a user-supplied address and
authors a high-quality Product Requirements Document that feeds the downstream pipeline. The PRD is product-level
(a PRD): what / why / for-whom, not how. Zero external calls — the PRD is authored as markdown in the specs
repo, which is where every downstream command reads it from.
Usage: /create-prd <ADDRESS> [@idea.md] [--from-prd <PRD-KEY|path>] [--lean|--hybrid|--full] [--no-docs] (default --hybrid, or --full on the BRD route — Phase 0 step 2; the two --no-* switches each turn off one grounding source — see Phase 1).
Phase 0 — Resolve inputs
-
The address (mandatory). Parse the first non-flag token and validate it with
key-valid(${CLAUDE_PLUGIN_ROOT}/references/addressing.md§1). If absent or malformed, stop gracefully with the oneCREATE_PRD_NEEDS_KEYtext below — there is one stop for this code, not two. (Shape only, and never checked against anything: the key is the operator's own and names a folder in$SPECS_PATH; nothing mints it and nothing verifies it.)The BRD route is detected, not declared. A folder carrying
brd-link.mdwas produced by/brd-splitand holds the seeds this command reads; the operator restates nothing on the command line, and there is no flag that could disagree with the folder it names. Detection therefore waits on resolution. The address is resolved once, withresolve-address(step 5), and that resolution is taken as soon as step 2b has settled$SPECS_PATH— ahead of step 2's profile default and step 3's ladder, both of which read the route. Print which route the run entered at that point, before any other work. Where the address resolves to nothing there is no folder and nobrd-link.mdto read one off, so the run is on the idea route; step 5 says what happens then, and it is not a stop. A key that fails §1's grammar stops withCREATE_PRD_NEEDS_KEY: /create-prd needs an address (^[A-Z][A-Z0-9_]*(-\d+)+$, e.g. EPIC-008 or the slice EPIC-008-01) — re-run '/dev-workflows:create-prd <ADDRESS>'. -
Profile.
--lean | --hybrid | --full; default--hybrid— or--fullwhen the BRD route is present and no profile flag was given, per the design's Profile default section (§7.4): that profile is the one carrying## Functional requirements([FR#N]),## API specification,## UX prototype / UI mockupsand the full## Assumptions & open questionsContradictions Log, so considerably more BRD-derived content has a legitimate product-altitude home than--hybridallows. An explicit--lean/--hybridstill wins: the default is a default, not an override. 2a.--from-prd <PRD-KEY|path>(optional seed). When present, this run authors a new PRD (the positional<KEY>) seeded read-only by another PRD. Resolve the seed viaresolve-address(${CLAUDE_PLUGIN_ROOT}/references/addressing.md§3) and read that folder'sprd.mdfor a key, or read the given path directly. The seed is grounding, not content (Phase 3 adapts it; it is never copied wholesale).
2b. $SPECS_PATH, then the specs-repo preflight — both before step 3's gate. If $SPECS_PATH is
unset, stop naming it (choices: ["Set SPECS_PATH (enter the path)", "Cancel"]). Then cite
${CLAUDE_PLUGIN_ROOT}/references/specs-repo-git.md and execute its specs-preflight entry point
(§3) inline: flush any leftover session artifacts from an earlier run, retry an artifact commit
that failed to push, and settle the branch. Prompt-free and silent when the specs repo is clean and
on its default branch. If a guard fires, emit its §5 notice; if it returns specs_git: blocked
(§3.3 G0), carry that flag for the whole run — the terminal commit-artifacts step skips on it.
**The ordering is the point, not the tidiness.** Step 3's `require-on-main` performs no fetch of
its own (`${CLAUDE_PLUGIN_ROOT}/references/phase-handoff.md` §3), so without the preflight's
best-effort fetch ahead of it a merged `idea.md` reads as "on a branch and never handed off" and
the run hard-stops on work that is already on the default branch. This command was for a time the
only one of the twenty-four `commit-artifacts` callers running no preflight — deleted as
collateral with an adjacent paragraph — which also left `specs_git: blocked` unset, so the G0
guard in both `commit-artifacts` and `handoff-to-main` was inert here and a detached-HEAD specs
repo would take this command's commits to an unreachable place and report success.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +34 lines 904ac36929ba
- 5d ago First seen · 631 lines · 0 tokens per session scan A 53d475519ce5
create-prd is a command published in the GitHub repository ihudak/ihudak-claude-plugins (2 stars, last pushed 2d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 17,884 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
doctor
Check that the review-gate push gate is actually wired up and able to run. Reports which adapters are active, whether the reviewer can be located, and any version skew between the plugin and the global git hook. Use when a push was not reviewed, when a gate error told you to run the doctor, or after installing or…
battlecard
Create a sales-ready competitive battlecard — positioning, feature comparison, objection handling, and win strategies.
cloudflare-r2:presigned-url
Generate presigned URLs for secure client-side uploads or downloads.
create_handoff
Create handoff document for transferring work to another session.
sheet-report
Analyze a Numbers or Excel file and generate a report with charts.
pi-code-review
Adversarial code review via Codex — break confidence in changes, not validate them.