readme-generator-free
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository manifests and source files to generate documentation.
- Ingestion points: Project manifest files such as package.json, requirements.txt, and Cargo.toml, as well as source code comments and docstrings.
- Boundary markers: The instructions do not specify the use of delimiters or explicit 'ignore' instructions when interpolating external content.
- Capability inventory: The agent is authorized to execute --help commands on discovered binaries to extract usage examples.
- Sanitization: No explicit sanitization or validation of the extracted strings is performed before they are included in the generated README.
- [COMMAND_EXECUTION]: The skill allows the agent to run local commands to gather metadata.
- Evidence: SKILL.md permits running --help commands with safety constraints, such as avoiding mutation, network calls, or installation tasks.
Audit Metadata