docs-steward
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill functions as an orchestrator for external markdown formatting tools. As implemented in
scripts/docs_steward/process.py, it executes local binaries usingsubprocess.runwithshell=False. This prevents shell injection vulnerabilities. Arguments are passed as an explicit list, and binary resolution is handled viashutil.whichagainst a pre-defined set of common installation paths.\n- [EXTERNAL_DOWNLOADS]: The filescripts/docs_steward/hints.pycontains a reference tohttps://dprint.dev/install.shwithin a string literal. This is intended to be displayed to the user as a suggested installation method for thedprinttool. The skill's logic does not perform any network requests or automated execution of this remote script; it is used only for informative reporting.\n- [SAFE]: The skill adheres to the 'no-auto-install' principle and operates locally on the repository files. No evidence of data exfiltration, obfuscation, or prompt injection was found during the analysis.
Audit Metadata