zod
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The
scripts/sync-docs.shscript downloads documentation from GitHub and usescurlto fetch commit metadata, which is processed using a static Python command to extract specific JSON fields. These operations are restricted to a well-known service (GitHub) and are consistent with the skill's purpose of synchronizing documentation. - [EXTERNAL_DOWNLOADS]: The maintenance script
sync-docs.shfetches documentation from the official Zod repository on GitHub. This activity is transparently documented and targets a trusted, well-known service. - [INDIRECT_PROMPT_INJECTION]: The skill processes external documentation, which represents a potential surface for indirect prompt injection. This is mitigated by pinning the content to a specific, verifiable GitHub commit SHA.
Audit Metadata