code-documentation
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill researches project files (source, tests, config) to build documentation, which creates a surface for indirect prompt injection. Malicious instructions in the codebase could influence the agent's behavior during documentation generation. (Ingestion points: references/project-research.md; Capability inventory: mkdir, cp, npm, vercel; Sanitization: none mentioned; Boundary markers: none).
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands for file management and project research, and uses build tools like
npmandnext. These are standard for managing and building a documentation project. - [EXTERNAL_DOWNLOADS]: The documentation website workflow involves downloading packages from the NPM registry and deploying to Vercel. These are well-known, trusted services for web development.
Audit Metadata