add-doc-updater
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill generates a Python script by substituting user-provided variables into a markdown template and then executes this script using the
uvtool to validate its functionality. - [EXTERNAL_DOWNLOADS]: The generated synchronization script is designed to download documentation archives (zip or tar.gz) from remote URLs provided by the user or inferred from the environment.
- [COMMAND_EXECUTION]: The skill executes various system commands and developer tools, including
ruff,mypy,pyright, anduv, to format, lint, type-check, and run the generated code. - [INDIRECT_PROMPT_INJECTION]: The skill processes external documentation which is subsequently indexed in a
SKILL.mdfile, creating a vector for instructions embedded in remote data to influence agent behavior. - Ingestion points: Documentation archives are downloaded from the user-specified
DOC_SOURCE_URLand extracted locally. - Boundary markers: The processed documentation titles and descriptions are placed within a designated
## Documentation Indexsection in the targetSKILL.mdfile. - Capability inventory: The skill and its generated script have the capability to write to the filesystem, execute shell commands, and perform network requests.
- Sanitization: The workflow includes "markdown grooming" to remove Hugo shortcodes and transform links for AI consumption, but it does not perform explicit sanitization of natural language instructions within the documentation.
Audit Metadata