code-documentation

Pass

Audited by Gen Agent Trust Hub on May 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill researches project files (source, tests, config) to build documentation, which creates a surface for indirect prompt injection. Malicious instructions in the codebase could influence the agent's behavior during documentation generation. (Ingestion points: references/project-research.md; Capability inventory: mkdir, cp, npm, vercel; Sanitization: none mentioned; Boundary markers: none).
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands for file management and project research, and uses build tools like npm and next. These are standard for managing and building a documentation project.
  • [EXTERNAL_DOWNLOADS]: The documentation website workflow involves downloading packages from the NPM registry and deploying to Vercel. These are well-known, trusted services for web development.
Audit Metadata
Risk Level
SAFE
Analyzed
May 14, 2026, 03:11 PM
Security Audit — agent-trust-hub — code-documentation