document
Pass
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs legitimate project documentation tasks. It scans the repository for metadata (package.json, directory structures) and source code to generate structured documentation in various formats.- [PROMPT_INJECTION]: This skill possesses an inherent surface for indirect prompt injection as it ingests untrusted codebase data to generate documentation. However, given the primary purpose of the skill and the frequent human-in-the-loop validation checkpoints, this risk is considered acceptable.
- Ingestion points: Phase 1 (package.json, codebase scan), Phase 2 (target file/directory read), and Phase 6 (full source file reads during generation).
- Boundary markers: The skill does not explicitly describe the use of delimiters or boundary markers to isolate the analyzed source code from the agent's internal instructions.
- Capability inventory: The skill utilizes the Read tool for file access, the TaskList tool for tracking progress, and the AskUserQuestion tool for interaction. It also performs file writing operations during the generation phase.
- Sanitization: While no specific sanitization techniques are detailed, the skill mandates generating a sample section for user approval of style and depth before continuing with full documentation generation.
Audit Metadata