sync-docs
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several shell commands for development workflows, including
terraform-docsfor generating documentation,uv runfor executing local validation scripts,rg(ripgrep) for searching variables, andterraform fmtfor code formatting. These are standard operations for managing Infrastructure-as-Code projects. - [EXTERNAL_DOWNLOADS]: The skill utilizes the
geminiCLI tool to process file content via Google's Gemini models. This involves transmitting local file metadata and content (e.g., fromvariables.tf) to a well-known service for analysis, which is the intended purpose of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes untrusted data from repository files.
- Ingestion points: Reads content from
variables.tf,docs/llms.md,kube.tf.example, andREADME.mdto identify gaps and update documentation (Steps 1, 2, 5, and 7). - Boundary markers: Absent; the instructions do not use specific delimiters or instructions to ignore instructions embedded within the source files.
- Capability inventory: The skill has the capability to execute shell commands (
uv run,gemini,terraform-docs,rg) and perform file system writes to update repository documentation. - Sanitization: No explicit sanitization or escaping is performed on the ingested file content before it is processed by the CLI tools. However, in the context of a documentation synchronization tool for a specific project, this is a standard operating risk.
Audit Metadata