jsdocs
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run
pnpm jsdocs --checkand other root validation commands to verify documentation integrity. This is a standard development practice for maintaining codebase documentation quality and consistency within the project environment. - [INDIRECT_PROMPT_INJECTION]: The workflow requires the agent to ingest untrusted data by inspecting existing declarations, implementations, and JSDoc within the codebase (SKILL.md).
- Ingestion points: The agent reads declarations, implementation code, nearby JSDoc comments, tests, and call sites.
- Boundary markers: The skill enforces a strict multiline JSDoc template with specific headers (When to use, Details, Gotchas) and tag orders, which provides a structured schema for the output.
- Capability inventory: The agent can execute project validation scripts via
pnpm. - Sanitization: No specific sanitization of the ingested code is mentioned, but the focus on structured documentation output reduces the likelihood of an attacker-controlled comment influencing the agent's behavior beyond the documentation task.
Audit Metadata