docs-fix-changelog
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches canonical documentation from official Elastic domains (https://www.elastic.co) and metadata from Elastic's official GitHub repository (github.com/elastic). These are trusted sources according to the vendor context, used specifically to keep the skill in sync with current writer standards.
- [COMMAND_EXECUTION]: The skill provides suggested commands for the user to copy and run (
docs-builder changelog add). These are presented for user review and action, not executed automatically. The skill explicitly states it does not create files itself. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data (PR descriptions, issue titles, YAML files). It mitigates risks by including a detailed 'Confidence + Assumptions' section that makes assumptions transparent to the user and requires explicit confirmation before any disk writes occur. This visibility reduces the risk of the agent blindly following instructions embedded in untrusted content.
- [DATA_EXPOSURE]: The skill reads repository configuration (
docs/changelog.yml) to validate areas. This is a legitimate operation within the project workspace to ensure data integrity and does not involve sensitive credentials or personal data.
Audit Metadata