code-documenter
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs automated validation of code examples and specifications using local system tools as part of its core workflow.
- Evidence: Use of
python -m doctest,pytest --doctest-modules,tsc --noEmit, andnpx @redocly/cli lintfor validating documentation accuracy. - [EXTERNAL_DOWNLOADS]: The documentation workflow recommends installing various standard linting and static site generation tools from official registries.
- Evidence: Instructions to install
pydocstyle,interrogate,linkchecker,eslint-plugin-jsdoc, andbroken-link-checkervia standard package managers. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied code and specifications, which it then executes or lints, creating a potential vector for indirect prompt injection if the user code is malicious.
- Ingestion points: The skill reads user-provided source files (Python, TypeScript, JavaScript) and API specifications (OpenAPI, GraphQL) to generate and validate documentation.
- Boundary markers: The skill workflow does not specify the use of boundary markers or instructions to ignore embedded commands when performing validation steps.
- Capability inventory: The skill possesses the capability to execute code via
pythonandpytest, and run shell commands vianpxand local binary execution (tsc,linkchecker). - Sanitization: No explicit sanitization or filtering of code blocks within user-provided files is described before they are passed to validation tools.
- [DYNAMIC_EXECUTION]: The skill utilizes automated testing frameworks to dynamically execute code snippets found within documentation strings.
- Evidence: Automated execution of Python
doctestblocks andpytestmodule-wide checks to ensure documentation examples are functional.
Audit Metadata