docs-search

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses npx to execute the @arabold/docs-mcp-server command-line tool. This is the primary method for searching the documentation index, listing indexed libraries, and resolving version matches as described in the instructions.
  • [EXTERNAL_DOWNLOADS]: The npx command downloads the latest version of the @arabold/docs-mcp-server package from the npm registry at runtime. This package is an official resource from the skill author and is necessary for the skill's functionality.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied natural language queries and retrieves external documentation content, creating a potential surface for indirect prompt injection.
  • Ingestion points: The <query> argument in the search command and the documentation passages returned by the server (SKILL.md).
  • Boundary markers: No specific boundary markers or instructions are provided to help the agent distinguish between its core instructions and data retrieved from the documentation index.
  • Capability inventory: The skill has the capability to execute shell commands via npx (SKILL.md).
  • Sanitization: There is no mention of sanitization or validation for the queries or the content retrieved from the documentation server.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 11:04 AM