document-project
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes untrusted data from the project being documented, such as manifest files and existing markdown documentation, and uses that data to inform its generation logic.
- Ingestion points: The skill reads project manifests like package.json or pyproject.toml and existing documentation files (.md, .rst, .adoc) during Phase 1 and Phase 2 of the workflow.
- Boundary markers: There are no explicit instructions or delimiters used to ensure the agent treats content from these files as data rather than instructions, which could allow an attacker to embed malicious commands in a project's README or manifest.
- Capability inventory: The skill is granted access to high-privilege tools including Bash, PowerShell, Write, and Edit, which could be misused if the agent is successfully injected.
- Sanitization: The skill lacks validation or sanitization of the content extracted from external project files before it is processed by the model.- [COMMAND_EXECUTION]: The skill uses the Bash and PowerShell tools to execute shell commands to map the project structure and audit existing files.
- Evidence: Phase 1 and Phase 2 in SKILL.md utilize commands like ls, find, and grep to identify language manifests, entry points, and existing documentation paths.
Audit Metadata