document-studio
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses local Python scripts located in the
scripts/directory to manage document lifecycle, indexing, and Kanban boards. These scripts handle file creation, metadata parsing, and CSV indexing based on user-provided documentation templates. All operations are local and consistent with the skill's primary purpose of document management. - [COMMAND_EXECUTION]: The instructions direct the agent to execute specific local Python scripts (e.g.,
python3 scripts/init_document.py,python3 scripts/kanban.py). This is a legitimate use of the agent's environment to provide automated documentation workflows. The scripts include input normalization (kebab-case) to mitigate common command injection risks during file creation. - [DATA_EXPOSURE_&_EXFILTRATION]: No evidence of hardcoded credentials, sensitive file path access (outside of the project scope), or network exfiltration patterns was found. The skill does not perform any external network requests.
- [INDIRECT_PROMPT_INJECTION]: The skill processes markdown files and their metadata (YAML frontmatter) to build indexes. While this constitutes an ingestion point for untrusted data, the processing is limited to structured metadata extraction and validation against predefined enums, posing minimal security risk.
Audit Metadata