write
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- Automated Command Execution via Hooks: The skill utilizes a
PostToolUsehook to triggerscripts/post-edit.shautomatically after file modifications. This script executesnpx prettierto ensure consistent formatting. This is a common automation pattern for maintaining repository standards. - Local Script Integration: The workflow directs the agent to execute
scripts/lint.shfor manual validation. Using repository-specific scripts is a standard practice for enforcing project-specific quality controls. - External Tooling and Dependencies: The formatting hook employs
npxto runprettier. Whilenpxcan fetch packages from the public registry if not present locally,prettieris a well-recognized and trusted formatting utility. - Indirect Prompt Injection Surface: As the skill is designed to read and process documentation files, it naturally interacts with untrusted data which could contain embedded instructions.
- Ingestion points: Markdown files (
.md) read during the research and edit phases. - Boundary markers: No specific delimiters or "ignore" instructions are used when the agent reads file content.
- Capability inventory: Git operations (branching, staging, committing), shell script execution (
post-edit.sh,lint.sh), and external command execution vianpx. - Sanitization: The skill does not perform content sanitization or validation of the text read from documentation files prior to editing.
Audit Metadata