catalog-documentation-creator
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
npx @eventcatalog/create-eventcatalog@latestto initialize new documentation projects. This is a standard and expected operation for bootstrapping an EventCatalog instance. - [EXTERNAL_DOWNLOADS]: The skill fetches the official EventCatalog scaffolding package from the public npm registry during the project creation phase.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies user-provided system descriptions and codebase contents as sources for documentation generation, which constitutes an ingestion of untrusted data into the agent context.
- Ingestion points: User input describing architectural resources and the content of provided source code repositories (Step 2, SKILL.md).
- Boundary markers: No explicit delimiters are defined to isolate user-provided data from the agent's operating instructions.
- Capability inventory: The agent has the ability to write multiple documentation files to the local file system and execute project initialization commands.
- Sanitization: No specific data cleaning or verification steps are outlined in the instructions; the agent is expected to parse the data according to the provided reference templates.
Audit Metadata