manage-gitbook-site
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill automates site management by executing local shell commands such as
git,gh,glab,sed,find, andxargs. It also integrates with the 1PasswordopCLI to fetch sensitive API tokens, which follows security best practices for secret handling by avoiding hardcoded credentials or plaintext environment variables. - [PROMPT_INJECTION]: The skill ingests and processes untrusted user-provided data, such as markdown folders and existing site notes, which serves as a potential surface for indirect prompt injection attacks.
- Ingestion points: The skill takes source content from arbitrary user-supplied markdown folders and external documentation seeds described in
SKILL.md. - Boundary markers: Absent. There are no instructions for the agent to use specific delimiters or to disregard instructions found within the processed content.
- Capability inventory: The agent can execute system commands (
git,sed,gh), perform network requests to the GitBook API, and access secret management tools. - Sanitization: Absent. User content is manipulated using text-processing tools and API payloads without explicit filtering of potential malicious instructions.
Audit Metadata