dev-guides-navigator
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches guide indices (
llms.txt,agentic-recipes.txt) and markdown content from the author's GitHub Pages domain (camoa.github.io) and the official GitHub raw content service (raw.githubusercontent.com). An SSRF guard is implemented to validate that all remote fetches target the expected repository prefix. - [COMMAND_EXECUTION]: System utilities such as
curl,jq,sed, andcpare utilized to manage a local content-addressable store (~/.claude/dev-guides-store/) and a per-project cache within the project's memory directory. - [PROMPT_INJECTION]: The skill incorporates defensive prompt engineering by explicitly instructing the agent to treat fetched markdown bodies as reference material rather than a source of commands. This prevents the agent from following instructions potentially embedded within the documentation it retrieves.
Audit Metadata