docs-governance
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes several
pnpmscripts (such asdocs:check,lint, anddocs:affected) andgitcommands for repository maintenance and validation. These commands are typical for a development workflow and are used for their intended purpose of checking documentation and code health. - [INDIRECT_PROMPT_INJECTION]: The skill reads data from repository files which could theoretically contain malicious instructions.
- Ingestion points: The agent is instructed to read
AGENTS.md, module READMEs, and files within thedocs/directory. - Boundary markers: The instructions do not specify the use of delimiters or ignore-behavior warnings when reading these files.
- Capability inventory: The agent can execute
pnpmandgitcommands as defined in the governance process. - Sanitization: There are no explicit sanitization steps mentioned for the processed documentation content. Although this represents a vulnerability surface, the risk is localized to the repository's own documentation files.
Audit Metadata