avo-coder
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill fetches documentation from
https://docs.avohq.io/3.0/llms-full.txt. This is the official documentation source for the Avo framework and is consistent with the skill's intended purpose. - [COMMAND_EXECUTION]: The skill uses the
Bashtool to execute standard Rails generator commands (e.g.,bin/rails generate avo:resource). These are expected and legitimate development actions. - [INDIRECT_PROMPT_INJECTION]: The skill retrieves external data, creating a theoretical attack surface.
- Ingestion points:
WebFetchis used inSKILL.mdto fetch documentation. - Boundary markers: The skill does not define specific delimiters for separating the fetched content from system instructions.
- Capability inventory: The agent has access to
Bash,Write,Edit,Read,Grep, andGlobtools. - Sanitization: No specific sanitization or filtering of the fetched content is described.
- Note: This ingestion is considered safe because it targets a well-known official domain relevant to the skill's primary function.
Audit Metadata