project-docs-management
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]:
- The skill fetches an installation script (
install.sh) and project assets from the author's official GitHub repository (github.com/devcxl/cabbage). - It downloads project configuration and workflow templates during initialization.
- [REMOTE_CODE_EXECUTION]:
- The project documentation recommends an installation flow that pipes a remote shell script from GitHub directly to the bash interpreter to set up the environment.
- This script automates repository cloning and virtual environment configuration.
- [COMMAND_EXECUTION]:
- The CLI tool utilizes system commands such as
gitfor repository management, change detection, and verifying documentation gates. - It uses
pnpmto manage Node.js dependencies and build the integrated VitePress documentation site. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill processes Markdown files (artifacts) located in
.cabbage/changes/anddocs/(as seen incabbage_cli/core.py). - Boundary markers: The system uses specific section headings (e.g.,
## Goal) and task checkboxes as structural markers for validation. - Capability inventory: The skill can execute shell commands via
subprocessto interact with Git and pnpm (as seen incabbage_cli/cli.pyandcabbage_cli/core.py). - Sanitization: The skill performs structural validation and placeholder detection but does not perform extensive filtering of natural language content before it is processed by the agent.
Audit Metadata