create-tldr-page
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and potentially fetches markdown examples from an untrusted GitHub repository (
https://raw.githubusercontent.com/jhauga/tldr/...) to use as stylistic references for generating documentation. These files are provided as examples for the agent to understand the target format. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process data from arbitrary documentation URLs provided by the user using the
#fetchtool. It lacks explicit instructions to ignore or sanitize potentially malicious commands or instructions that could be embedded within the external documentation it retrieves. - Ingestion points: Processes content from user-provided URLs and context files (
SKILL.md). - Boundary markers: The skill defines a strict markdown template for output but does not provide delimiters or instructions to the agent to treat fetched content as data only.
- Capability inventory: The skill leverages the platform's
#fetchtool and generates markdown text based on retrieved content. - Sanitization: There is no evidence of input validation, filtering, or escaping for the data fetched from external sources.
Audit Metadata