docs-manage
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx @arabold/docs-mcp-server@latestto execute various management tasks. This command downloads the latest version of the tool from the npm registry at runtime. As this package is owned by the skill's vendor, it is considered a legitimate resource, though using the unpinned@latestversion introduces a minor supply chain dependency on the registry.\n- [COMMAND_EXECUTION]: Functionality is delivered via shell command execution using thenpxutility for scraping, refreshing, and managing local or remote documentation indexes.\n- [DATA_EXFILTRATION]: The skill supports a--server-urlflag to use a remote worker and a--headerflag for custom HTTP headers (e.g., authorization tokens). While these are necessary for its intended use case, they provide a mechanism for sending indexed data or credentials to external endpoints if the agent is directed to untrusted servers.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests content from external URLs and local files to build a documentation index. This capability presents a surface for indirect prompt injection if the ingested data contains instructions designed to manipulate the agent.\n - Ingestion points: External URLs and absolute local file paths provided to the
scrapecommand.\n - Boundary markers: There are no explicit delimiters defined in the instructions to isolate processed content from the agent's control context.\n
- Capability inventory: The skill possesses the ability to execute shell commands, perform network operations, and read/write to the local file system (via SQLite storage).\n
- Sanitization: No documentation exists within the skill regarding the filtering or sanitization of the scraped content to prevent instruction obedience.
Audit Metadata