bento-docs
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is instructed to read and follow external instruction files within the target repository, specifically
AGENTS.md,CLAUDE.md, and.agents/bento/bento-docs.md. An attacker who can commit to the repository could include malicious instructions in these files to hijack the agent's behavior during documentation tasks. - Ingestion points: The skill explicitly reads repo-level configuration files (
AGENTS.md,CLAUDE.md) and directory-specific overlays (.agents/bento/bento-docs.md). - Boundary markers: The instructions lack explicit delimiters or warnings to ignore embedded commands within the ingested files.
- Capability inventory: The agent has the ability to read and write files, as well as execute shell commands to verify documentation examples.
- Sanitization: No sanitization or validation of the ingested instructions is described.
- [COMMAND_EXECUTION]: The skill requires the agent to verify documentation by running examples ('if there are runnable examples, run them'). This behavior allows the execution of arbitrary code contained within the project's documentation or source files.
Audit Metadata