docs-init
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install or execute the
@mermaid-js/mermaid-clipackage vianpmornpxfrom the official NPM registry to perform diagram validation. This is a well-known tool from a recognized service. - [COMMAND_EXECUTION]: The skill executes various shell commands such as
find,grep,awk, andgitto discover project structures, identify the technology stack, and extract information for documentation templates. - [DYNAMIC_EXECUTION]: In Step 7, the skill employs a shell script that uses
awkto extract Mermaid diagram blocks from generated documentation files into temporary.mmdfiles, which are then processed by themmdcCLI tool. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local repository (e.g.,
README.md, package manifests, and source code) to automatically fill placeholders in documentation templates. - Ingestion points: Local files are read during the exploration phase (Step 1) and template population phase (Step 5).
- Boundary markers: The skill includes 'Anti-hallucination guidelines' requiring the agent to verify claims against the codebase and use quotes for names, which helps ground the output.
- Capability inventory: The skill can read/write to the file system and execute shell commands and Node.js packages.
- Sanitization: The skill relies on specific grep-based token mapping but does not specify sanitization or escaping of the content extracted from the codebase before it is interpolated into the final documentation files.
Audit Metadata