code-tour
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary purpose is the generation of .tour documentation files for the VS Code CodeTour extension.
- [DATA_EXFILTRATION]: The skill requires reading repository files to verify paths and line numbers for the tour steps. This is a legitimate functional requirement and is performed without any associated network requests to external or untrusted domains.
- [COMMAND_EXECUTION]: Instructions explicitly forbid the modification of source code and limit the agent's scope to reading files and writing new JSON documentation to a specific subdirectory.
- [PROMPT_INJECTION]: The skill processes untrusted data from the codebase, which represents an attack surface for indirect prompt injection. This is addressed by restricting the agent's output capabilities to structured JSON documentation.
Audit Metadata