tools-report-markdown
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes common command-line tools such as
jq,yq,prettier, andcodespellto validate and format documentation artifacts. It also includes a Python one-liner to extract YAML frontmatter to a temporary file for processing.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-generated Markdown files (report.md) through various renderers and validators. While this presents an ingestion surface for external content, the tools employed (e.g.,mmdcfor diagrams,lycheefor links) are restricted to their specific functional domains. Findings: 1. Ingestion points:report.md2. Boundary markers: Absent 3. Capability inventory: Network access (lychee), subprocess execution (npm,mmdc,dot,d2) 4. Sanitization: Absent. The severity is low as these are standard document processing workflows.\n- [EXTERNAL_DOWNLOADS]: Thelycheetool is used to verify links within reports, which involves making outbound network requests to external domains. This behavior is expected and necessary for the tool's primary purpose of link validation.
Audit Metadata