module-governance
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a Python script to perform link checking and documentation auditing:
python3 <docs-governance-skill>/scripts/audit-docs.py --root <repository> --scope modules --module <module-directory>. - [DYNAMIC_EXECUTION]: The skill executes a script from a path determined by the installation location of a related skill (
<docs-governance-skill>), representing a dynamic execution pattern used for internal tool orchestration. - [INDIRECT_PROMPT_INJECTION]: The skill ingests various untrusted project files to discover module boundaries and establish rules, which creates an attack surface for embedded malicious instructions.
- Ingestion points: Reads project instructions, requirements, code, and contracts in Step 1 (SKILL.md).
- Boundary markers: Absent; there are no explicit instructions for the agent to use delimiters or ignore instructions within the ingested content.
- Capability inventory: Command execution (
python3) and file system write access for documentation updates. - Sanitization: None; the skill does not describe any validation or filtering of the content read from the repository.
Audit Metadata