do-readme-update

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script update-readme.sh executes several standard shell commands (git, find, awk, sed) to navigate the repository and process file contents. These operations are scoped to the local repository root and used for their intended purpose of repository maintenance.
  • [INDIRECT_PROMPT_INJECTION]: The skill implements a catalog generation pattern that reads metadata (name and description) from all SKILL.md files in the repository and writes them into various README.md files.
  • Ingestion points: Reads name and description frontmatter from SKILL.md files throughout the skills/ directory.
  • Boundary markers: None; the content is interpolated directly into Markdown tables.
  • Capability inventory: The script has the capability to write to multiple README.md files across the repository structure.
  • Sanitization: It performs basic escaping of pipe characters (|) to maintain Markdown table integrity and truncates descriptions to the first sentence.
  • [DYNAMIC_EXECUTION]: The script uses node -e to execute a small snippet of JavaScript code for parsing the skills.sh.json configuration file. The JavaScript code is hardcoded within the script and processes local data, which is a common pattern when specialized tools like jq are unavailable.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 12:42 AM