add-doc-updater

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill generates a Python script by substituting user-provided variables into a markdown template and then executes this script using the uv tool to validate its functionality.
  • [EXTERNAL_DOWNLOADS]: The generated synchronization script is designed to download documentation archives (zip or tar.gz) from remote URLs provided by the user or inferred from the environment.
  • [COMMAND_EXECUTION]: The skill executes various system commands and developer tools, including ruff, mypy, pyright, and uv, to format, lint, type-check, and run the generated code.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external documentation which is subsequently indexed in a SKILL.md file, creating a vector for instructions embedded in remote data to influence agent behavior.
  • Ingestion points: Documentation archives are downloaded from the user-specified DOC_SOURCE_URL and extracted locally.
  • Boundary markers: The processed documentation titles and descriptions are placed within a designated ## Documentation Index section in the target SKILL.md file.
  • Capability inventory: The skill and its generated script have the capability to write to the filesystem, execute shell commands, and perform network requests.
  • Sanitization: The workflow includes "markdown grooming" to remove Hugo shortcodes and transform links for AI consumption, but it does not perform explicit sanitization of natural language instructions within the documentation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 10:26 AM