skills/farming-labs/docs/cli/Gen Agent Trust Hub

cli

Pass

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The docs codeblocks validate command enables the execution of code snippets extracted from documentation (MD/MDX files) using various runners such as local environments, Vercel sandboxes, E2B, or Daytona. This is an intended primary feature for documentation quality assurance.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted documentation content which could theoretically contain malicious instructions or code snippets intended for the validation runner.
  • Ingestion points: Reads and parses Markdown/MDX files within the user's project directory.
  • Boundary markers: Uses code fence metadata (e.g., runnable) to identify candidate blocks for execution.
  • Capability inventory: Includes file system writes (scaffolding), network communication (cloud/search sync), and arbitrary code execution via configured runners.
  • Sanitization: The instructions recommend using the --plan flag before execution to review planned actions and require explicit configuration for runner providers.
  • [COMMAND_EXECUTION]: The skill relies on standard package manager runners (npx, pnpm dlx, yarn dlx, bunx) to invoke the latest version of the vendor's CLI tool for various lifecycle tasks.
  • [EXTERNAL_DOWNLOADS]: The CLI interacts with several well-known services and platforms for its operational needs, including Vercel, OpenAI, Typesense, Algolia, and E2B for deployment, indexing, and code execution environments.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 10, 2026, 10:00 AM
Security Audit — agent-trust-hub — cli