octocode-rfc-generator
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation instructs the user to set up an MCP server using the
octocode-mcppackage vianpx. This package is used to provide the agent with local and external code search capabilities. - [COMMAND_EXECUTION]: The agent utilizes a comprehensive set of Model Context Protocol (MCP) tools, including
localSearchCode,githubSearchCode, andpackageSearch, to explore codebases and gather evidence for technical proposals. - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it is designed to read and process content from untrusted external repositories which may contain malicious instructions.
- Ingestion points: Data is ingested through the
githubGetFileContentandpackageSearchtools during the research track inSKILL.md. - Boundary markers: No specific delimiters or safety instructions are defined to prevent the agent from following instructions embedded within the researched external code.
- Capability inventory: The agent has the capability to write files to the local
.octocode/rfc/directory and perform recursive repository searches. - Sanitization: The skill does not implement validation or sanitization of the content retrieved from remote sources before it is analyzed and incorporated into the output.
Audit Metadata