skills/mgiovani/cc-arsenal/docs-init/Gen Agent Trust Hub

docs-init

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install or execute the @mermaid-js/mermaid-cli package via npm or npx from the official NPM registry to perform diagram validation. This is a well-known tool from a recognized service.
  • [COMMAND_EXECUTION]: The skill executes various shell commands such as find, grep, awk, and git to discover project structures, identify the technology stack, and extract information for documentation templates.
  • [DYNAMIC_EXECUTION]: In Step 7, the skill employs a shell script that uses awk to extract Mermaid diagram blocks from generated documentation files into temporary .mmd files, which are then processed by the mmdc CLI tool.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local repository (e.g., README.md, package manifests, and source code) to automatically fill placeholders in documentation templates.
  • Ingestion points: Local files are read during the exploration phase (Step 1) and template population phase (Step 5).
  • Boundary markers: The skill includes 'Anti-hallucination guidelines' requiring the agent to verify claims against the codebase and use quotes for names, which helps ground the output.
  • Capability inventory: The skill can read/write to the file system and execute shell commands and Node.js packages.
  • Sanitization: The skill relies on specific grep-based token mapping but does not specify sanitization or escaping of the content extracted from the codebase before it is interpolated into the final documentation files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 05:06 PM