tools-report-markdown

Pass

Audited by Gen Agent Trust Hub on Aug 22, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes common command-line tools such as jq, yq, prettier, and codespell to validate and format documentation artifacts. It also includes a Python one-liner to extract YAML frontmatter to a temporary file for processing.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-generated Markdown files (report.md) through various renderers and validators. While this presents an ingestion surface for external content, the tools employed (e.g., mmdc for diagrams, lychee for links) are restricted to their specific functional domains. Findings: 1. Ingestion points: report.md 2. Boundary markers: Absent 3. Capability inventory: Network access (lychee), subprocess execution (npm, mmdc, dot, d2) 4. Sanitization: Absent. The severity is low as these are standard document processing workflows.\n- [EXTERNAL_DOWNLOADS]: The lychee tool is used to verify links within reports, which involves making outbound network requests to external domains. This behavior is expected and necessary for the tool's primary purpose of link validation.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 22, 2026, 10:31 AM
Security Audit — agent-trust-hub — tools-report-markdown