codedocs
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands such as
git diff,git log, andls. These commands are used to perform recursive directory censuses, detect changes for incremental updates via git history, and discover installed companion skills in local environment directories (e.g.,~/.claude/skills/). - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) as it ingests untrusted data from the local filesystem, including source code, manifest files (e.g.,
package.json,Cargo.toml,go.mod), and git diff outputs. This data is used to generate documentation prompts. Maliciously crafted content within the analyzed files (e.g., in comments or strings) could attempt to influence the agent's behavior during the documentation or Q&A process. - [EXTERNAL_DOWNLOADS]: The skill's documentation and activation instructions recommend installing companion skills using
npx skills add, which involves downloading and executing packages from the vendor's repository.
Audit Metadata