git-derive-docs

Pass

Audited by Gen Agent Trust Hub on Jul 31, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses dynamic context placeholders in the SKILL.md file to fetch repository status (branch name, commit count) at load time. These commands are limited to benign, read-only git operations.
  • [PROMPT_INJECTION]: The skill processes untrusted commit messages to detect missing documentation, creating a surface for indirect prompt injection. The risk is considered negligible as the impact is confined to local documentation skeleton generation. * Ingestion points: Commit history is read via git log and the git-derive-docs.sh script. * Boundary markers: None identified. * Capability inventory: The agent has access to Write, Edit, and Bash tools to modify repository documentation. * Sanitization: No explicit sanitization of commit messages is performed before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 31, 2026, 02:26 AM
Security Audit — agent-trust-hub — git-derive-docs