make-readme
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project manifest files to populate the generated documentation, creating a potential vector for indirect instructions. * Ingestion points: Scans package.json, pyproject.toml, Cargo.toml, go.mod, and subdirectory manifests (SKILL.md, Step 1 and Step 4). * Boundary markers: Absent. * Capability inventory: Uses Write tool to modify the filesystem (SKILL.md, Step 5). * Sanitization: Absent.
- [EXTERNAL_DOWNLOADS]: The skill references external badge images from a well-known service. * Evidence: Badge URLs in references/badges.md target img.shields.io.
Audit Metadata