git-derive-docs
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses dynamic context placeholders in the SKILL.md file to fetch repository status (branch name, commit count) at load time. These commands are limited to benign, read-only git operations.
- [PROMPT_INJECTION]: The skill processes untrusted commit messages to detect missing documentation, creating a surface for indirect prompt injection. The risk is considered negligible as the impact is confined to local documentation skeleton generation. * Ingestion points: Commit history is read via
git logand thegit-derive-docs.shscript. * Boundary markers: None identified. * Capability inventory: The agent has access toWrite,Edit, andBashtools to modify repository documentation. * Sanitization: No explicit sanitization of commit messages is performed before processing.
Audit Metadata