generating-documentation
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of external source code and API specifications to generate documentation, creating a surface for indirect prompt injection if the ingested data contains malicious instructions.
- Ingestion points: Source code files (TypeScript, Python, Go, Rust), OpenAPI specifications (YAML/JSON), and Architecture Decision Records (Markdown) as described in the reference guides and templates.
- Boundary markers: No explicit instructions are provided in the templates to delimit or sanitize external content before processing by the agent.
- Capability inventory: The workflow utilizes shell commands and automated tools (e.g., typedoc, sphinx, mkdocs) to generate documentation outputs, as detailed in the references directory.
- Sanitization: The skill does not define specific sanitization or validation steps for ingested content within its provided templates, relying on the underlying documentation generators' security postures.
- [EXTERNAL_DOWNLOADS]: The skill references and suggests the installation of well-known and reputable documentation packages from official registries such as NPM and PyPI. These tools (e.g., TypeDoc, Sphinx, MkDocs, and Redocly) are industry standards for documentation workflows.
- [COMMAND_EXECUTION]: Instructions provided within the skill and its references guide the agent or user to execute shell commands for building, serving, and deploying documentation projects, which is the primary intended behavior of the skill and occurs within standard developer workflows.
Audit Metadata