docs-gen
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates documentation management through several local shell commands and script executions:
- Executes a bundled Node.js script,
scripts/push-docs.mjs, which aggregates documentation files and pushes them to a user-specified central server using HTTP PUT requests. - Utilizes
git diff,git log, andgit statusto track source code changes and determine which documentation sections require updates. - Uses
rg(ripgrep) to perform identifier-based searches across the documentation directory for consistency checks. - [INDIRECT_PROMPT_INJECTION]: The skill generates documentation by processing source code, test files, and changelogs, which presents an attack surface for instructions hidden within codebase comments or string literals.
- Ingestion points: Library source code, type definitions, tests, and documentation files such as
README.mdandCHANGELOG.mdas outlined inSKILL.mdandchange-sync.md. - Boundary markers: The instructions in
SKILL.mdanddoc-standards.mdexplicitly direct the agent to document only factual exports and strictly adhere to defined formatting schemas to minimize training-data hallucinations and bias. - Capability inventory: The skill possesses the capability to perform network operations (HTTP PUT) via the
push-docs.mjsscript and write configuration files like.envand.mddocumentation files. - Sanitization: The documentation transmission script,
push-docs.mjs, includes aparseFrontmatterfunction that validates metadata integrity and ensures mandatory fields liketitleare present before attempting a push operation.
Audit Metadata