docs-search
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
npxto execute the@arabold/docs-mcp-servercommand-line tool. This is the primary method for searching the documentation index, listing indexed libraries, and resolving version matches as described in the instructions. - [EXTERNAL_DOWNLOADS]: The
npxcommand downloads the latest version of the@arabold/docs-mcp-serverpackage from the npm registry at runtime. This package is an official resource from the skill author and is necessary for the skill's functionality. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied natural language queries and retrieves external documentation content, creating a potential surface for indirect prompt injection.
- Ingestion points: The
<query>argument in the search command and the documentation passages returned by the server (SKILL.md). - Boundary markers: No specific boundary markers or instructions are provided to help the agent distinguish between its core instructions and data retrieved from the documentation index.
- Capability inventory: The skill has the capability to execute shell commands via
npx(SKILL.md). - Sanitization: There is no mention of sanitization or validation for the queries or the content retrieved from the documentation server.
Audit Metadata