doc
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes repository source code, manifests, and existing markdown files to generate documentation, which presents a surface for indirect prompt injection. The skill mitigates this risk through explicit instructions for grounded writing and a mandatory 'de-slopify' pass to manually recast generated content.
- Ingestion points: Repository source code, configuration files (e.g., package.json, go.mod), and existing documentation in SKILL.md and references/readme-craft.md.
- Boundary markers: Instructions emphasize grounding output in actual repository intent and verified executable behavior.
- Capability inventory: Capabilities include writing documentation files, creating evidence directories, and executing local shell scripts for repository auditing.
- Sanitization: Employs a 'de-slopify' pass (references/de-slopify.md) that requires manual line-by-line recasting of prose to remove prefabricated AI patterns and ensure factual accuracy.
- [COMMAND_EXECUTION]: The skill executes bundled shell scripts, including
scripts/audit-oss-docs.shandscripts/validate.sh, to perform documentation coverage audits and verify the structural integrity of the skill package and linked resources. - [DYNAMIC_EXECUTION]: The
scripts/validate.shutility executes an inline Python block to dynamically validate that all internal documentation links resolve correctly to local files within the repository context.
Audit Metadata