create-readme-expert
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides functionality to fetch external README files from GitHub repositories for structural inspiration. These fetches target well-known organizations (such as Azure-Samples) and are subject to mandatory user consent before the network request is performed.
- [INDIRECT_PROMPT_INJECTION]: As the skill is designed to ingest third-party documentation, it includes a comprehensive security model in
references/security.md. These instructions explicitly direct the agent to treat all fetched content as data, ignore any embedded imperative commands or warnings, and avoid copying prose or claims from external sources. - [SAFE]: The skill actively promotes security best practices by including guidance for the agent to warn users against committing secrets—such as
BOT_TOKENorMONGODB_URI—into their repositories, instead recommending secret managers and environment variables. - [DYNAMIC_EXECUTION]: The skill references a companion skill,
mermaid-diagrams-expert, for generating diagrams. It includes a fallback mechanism to dynamically fetch this skill from the vendor's official GitHub repository if it is not already installed in the environment.
Audit Metadata