readme-generator
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill was analyzed for security vulnerabilities including prompt injection, data exfiltration, and remote code execution. No malicious patterns were identified.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project files (e.g., manifest files and source code) to populate documentation templates. While this creates a potential surface for indirect prompt injection if project files contain adversarial content, the behavior is inherent to the skill's primary purpose of documentation generation.
- Ingestion points: Manifest files such as
package.json,pyproject.toml,go.mod, and project source files as described in Step 1 of SKILL.md. - Boundary markers: The instructions do not specify delimiters or explicit warnings for the agent to ignore instructions embedded within the processed project data.
- Capability inventory: The skill utilizes file system discovery (
ls) and file reading to gather project metadata for use in prompt interpolation. - Sanitization: No specific sanitization, escaping, or validation logic is defined for the content extracted from project files before it is included in the generated README.
Audit Metadata