oss-ready
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local repository it is processing (such as existing README files or project metadata) to analyze the project purpose and tech stack. This content is then used to inform the generation of new documentation and configuration files.
- Ingestion points: Step 1 ('Analyze Project') reads existing documentation and package manager files (SKILL.md).
- Boundary markers: No specific delimiters or instructions to ignore embedded content are used when the agent processes existing project data.
- Capability inventory: The skill uses
gitcommands to sync branches, creates/modifies various markdown files, and updates project metadata files likepackage.jsonorpyproject.toml(SKILL.md). - Sanitization: No explicit sanitization or validation of the ingested project data is performed before it is used to influence the agent's output.
Audit Metadata