technical-blog-doc
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill workflow (SKILL.md, Section 5) instructs the agent to execute shell commands and tests to verify the accuracy of the technical content it generates. The template (assets/technical-blog-template.md) also includes placeholders for setup, installation, and verification commands.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external data, specifically local source code repositories, to generate documentation (SKILL.md, Step 1). This creates a surface for indirect prompt injection where malicious comments or code in a repository could influence the agent. However, the skill explicitly instructs the agent to use placeholders for secrets, redact tokens, and only run 'safe' commands when authorized.
- [EXTERNAL_DOWNLOADS]: The skill identifies related documentation tools (full-stack-doc, api-doc-generator, doc-coauthoring) and provides commands to install them via 'npx'. These resources are part of the 'full-stack-skills' vendor ecosystem.
Audit Metadata