octocode-rfc-generator
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation suggests that the user manually install the
octocode-mcppackage usingnpxto enable research capabilities. This introduces a dependency on an external, unverified package outside of the standard trusted vendor list.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core research workflow.\n - Ingestion points: The agent retrieves data from external repositories and package registries using tools such as
githubSearchCode,githubGetFileContent, andpackageSearch(SKILL.md).\n - Boundary markers: The instructions do not define strict delimiters or warnings to the agent to disregard instructions that may be embedded in the retrieved code or documentation.\n
- Capability inventory: The agent has the ability to read local file contents (
localGetFileContent) and save generated RFC documents to the.octocode/rfc/directory.\n - Sanitization: There are no documented steps for validating or sanitizing the content retrieved from external research tracks before it is processed.
Audit Metadata