update-prd

update-prd is a command for Claude Code from ihudak/ihudak-claude-plugins. It costs 0 tokens per session (8,052 once invoked), scanned A, original, MIT.

A workflow for revising an existing Product Requirements Document (PRD), a document describing what a product should do, why it is needed, and who it is for.

In plain words
What is it for?
Use it to refresh or redo a PRD from the specifications tree, supporting documents, or discussion notes, with product-level review rather than code changes.
Why use it?
It keeps the canonical PRD aligned with new information and related specifications instead of allowing outdated scope or wording to remain.

Command for Claude Code

Written for Claude Code: allowed-tools in frontmatter.

Runs only inside its plugin — its command needs a path that Claude Code sets for a plugin’s own hooks and for nothing else. Install the plugin, not this.

Part of the product-workflows plugin — 12 commands, 12 agents shipped together

Good fit Use it to refresh or redo a PRD from the specifications tree, supporting documents, or discussion notes, with product-level review rather than code changes.

Compare 6 commands from other repositories ↓
Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code
/plugin marketplace add ihudak/ihudak-claude-plugins
Claude Code
/plugin install product-workflows

Made for: Claude Code.

Or install product-workflows, the plugin that ships this one along with the rest of its 12 commands, 12 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for update-prd

README.md
[![agentmods](https://agentmods.dev/badge/commands/ihudak/ihudak-claude-plugins/update-prd/github.svg)](https://agentmods.dev/commands/ihudak/ihudak-claude-plugins/update-prd)
Your own site
<a href="https://agentmods.dev/commands/ihudak/ihudak-claude-plugins/update-prd"><img src="https://agentmods.dev/badge/commands/ihudak/ihudak-claude-plugins/update-prd/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for update-prd

Your own site · 80×15
<a href="https://agentmods.dev/commands/ihudak/ihudak-claude-plugins/update-prd"><img src="https://agentmods.dev/badge/commands/ihudak/ihudak-claude-plugins/update-prd.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 8,052 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00000 $0.08052
Opus 5 $0.00000 $0.04026
Sonnet 5 $0.00000 $0.01610
Haiku 4.5 $0.00000 $0.00805

Measured today against content hash f1f4037d2998, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

update-prd scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/product-workflows/commands/update-prd.md · 195 lines

How it starts

The opening of the file, as written. The whole thing — 195 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Update the Product Requirements Document: $ARGUMENTS

Core references. A citation of the form workflows-core:<name> names a shared reference in the workflows-core plugin. Load it with Skill(skill: "workflows-core:reference", args: "<name>") — never by path: ${CLAUDE_PLUGIN_ROOT} resolves to this plugin, which does not carry it.

/update-prd refreshes an existing Product Requirements Document (PM phase). It covers routine refreshes (new information, scope tweaks, wording) and the rare obstacle-driven re-do (a human read an ARD/spec finding, discussed it, and decided the PRD must change). The PRD is product-level — what / why / for-whom, not how. Zero code scan; no repos.

Usage: /update-prd <KEY> [@transcript-or-notes ...] [--no-docs] [--docs <path>] (--no-docs turns off documentation grounding for the run — see Phase 1). --docs <path> — points documentation grounding at that root for this run instead of ${DOCS_PATH:-/workspace/docs}; strip the flag and its value together before any remaining-argument classification, or the path is read as part of the address. Declared for every consumer by workflows-core:docs-grounding §1's Flags first rung, which resolves it; this command only has to recognise it and pass the invocation through.


Phase 0 — Resolve inputs

  1. Flags. Strip --no-docs (boolean) and --docs <path>the flag and its value together — from $ARGUMENTS before anything else reads it. Both are carried to Phase 1's resolve-docs-grounding call and change nothing else. This step is load-bearing rather than tidy: Phase 1 step 5 consumes "any @transcript / notes path(s) passed in $ARGUMENTS", so an unstripped --docs value is read in as a grounding source and its content reaches the PRD.
  2. KEY (mandatory). Parse the first token that is neither a flag nor a flag's value — --docs each consume the token after them (step 0), and a value skipped as "non-flag" would be read as the key and validate it with key-valid (workflows-core:addressing §1) — the grammar is that file's, cited rather than copied here. If absent or malformed, stop: UPDATE_PRD_NEEDS_KEY: /update-prd needs the PRD's key — '/product-workflows:update-prd <KEY>'. The grammar is a superset of the two-segment form — every key that validated before still validates, so a PRODUCT-1234 refresh behaves exactly as it did — and it is the one this command needs for the same reason step 3's folder resolution is: a PRD authored inside a BRD slice by /create-prd on the BRD route carries a three-segment key (EPIC-008-01), and /create-prd redirects here on finding it. A validation narrower than /create-prd's would refuse that redirect at the door, which is the identical dead-end step 3 exists to close, one step earlier.
  3. $SPECS_PATH (required). If unset, stop naming SPECS_PATH (choices: ["Set SPECS_PATH (enter the path)", "Cancel"]).
  4. Feature folder. Resolve it with resolve-address <KEY> (Skill(skill: "workflows-core:reference", args: "addressing resolve-address"), §3), which searches every level §3 bounds and carries §5's legacy fallback; ambiguous → stop, naming every match and @<path> as the way through. status: absent is a stop, not a folder to create: surface the key dir not found rule in Skill(skill: "workflows-core:reference", args: "escalation-rules") (choices: ["Re-enter key", "Cancel"]) and name /product-workflows:create-prd <ADDRESS> as the run that authors a PRD where none exists. Named unqualified here and only conditionally at step 4, and the difference is what resolved: nothing did. There is no folder, so there is no brd-link.md, no gate set and no kind to test — ${CLAUDE_PLUGIN_ROOT}/references/coverage-ledger-format.md §5.2's Only a BRD-route folder has a gate set at all is the case that applies, and the container refusal that is /create-prd's third has no folder to fire on. Step 4 reports a folder that does exist, which is why it tests all three before it names that command. No matching rule is written here — §5 owns it.
  5. Resolve the base PRD. It is the prd.md in the folder step 3 resolved — the only copy there is, and therefore authoritative without a test. Absent → stop gracefully:
    UPDATE_PRD_NO_PRD: <ADDRESS> resolves a folder at <path> holding no prd.md, and /update-prd refreshes an existing PRD rather than authoring one. <the remedy, per the row below that matches>
    

Read the full file on GitHub · 195 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today Changed · +8 lines · -104 tokens per session f1f4037d2998
  2. 4d ago First seen · 187 lines · 104 tokens per session scan A 7c68d9d28076

Subscribe to this mod's changes

update-prd is a command published in the GitHub repository ihudak/ihudak-claude-plugins (2 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 8,052 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.