typescript-docs
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes project source code (
src/**) and configuration files to generate documentation. This establishes a vulnerability surface where malicious instructions could be embedded in code comments to influence the agent's behavior during documentation generation. - Ingestion points: TypeScript source files and documentation configuration files.
- Boundary markers: No specific delimiters or instructions are provided to the agent to treat content within source files as untrusted.
- Capability inventory: The skill uses
Read,Write,Edit,Bash,Grep, andGlobtools to perform its tasks. - Sanitization: No content filtering or sanitization is applied to the source code before processing.
- [EXTERNAL_DOWNLOADS]: The documentation includes commands to install standard, well-known development tools such as
typedoc,typedoc-plugin-markdown, and@compodoc/compodocvia the npm registry. These are legitimate tools for the TypeScript ecosystem. - [COMMAND_EXECUTION]: The skill utilizes shell commands via
Bashfor routine development operations, including installing dependencies, generating documentation withnpx, and running a local documentation server using Python's built-inhttp.servermodule.
Audit Metadata