generating-project-docs
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute local shell commands such as
bun src/cli.ts,find, andgit logto inventory repository assets and gather recent change context. These operations are restricted to the local filesystem for documentation purposes. - [PROMPT_INJECTION]: The skill ingests data from repository files which constitutes an indirect prompt injection surface.
- Ingestion points: Processes content from
package.json,SKILL.mdfrontmatter, and agent documentation files. - Boundary markers: No explicit delimiters are used for the ingested file content within the generation instructions.
- Capability inventory: Includes shell command execution capabilities (
bun,find) and the ability to modify project documentation files (README.md,ARCHITECTURE.md,STRUCTURE.md). - Sanitization: The skill contains explicit 'Quality Checks' requiring the agent to redact API keys, credentials, internal URLs, and local paths before saving the generated content.
Audit Metadata