The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to execute documentation generation commands and linters across various stacks. These include dart doc, ./gradlew dokkaGenerate, cargo doc, xcodebuild docbuild, and sphinx-build. These are legitimate uses of shell execution within the context of a documentation toolchain.
[EXTERNAL_DOWNLOADS]: The skill provides instructions to download and run development tools from well-known registries at runtime. Specifically, it uses npx to fetch tools like @redocly/cli, typedoc, and dependency-cruiser from NPM, and go run to fetch pkgsite from golang.org. As these targets are well-known technology services, these operations are considered safe.
[PROMPT_INJECTION]: The skill processes untrusted content from source code comments, API specifications, and git logs (Indirect Prompt Injection surface).
Ingestion points: Reads source files (.kt, .dart, .swift, .rs, .cpp, .ts, .py, .go), API specs (openapi.yaml, swagger.json), and commit messages.
Boundary markers: The instructions do not specify explicit delimiters to separate untrusted code content from agent instructions during processing.
Capability inventory: The agent has access to Bash for command execution and Write/Edit for file system modifications.
Sanitization: The skill does not explicitly mention sanitization or validation of the ingested code content before processing it.

documentation-generator