code-documenter
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to validate documentation and test code examples.
- Evidence: SKILL.md specifies the use of
python -m doctest,pytest --doctest-modules,tsc --noEmit, andnpx @redocly/cliduring the validation workflow step. - [EXTERNAL_DOWNLOADS]: The skill references the installation of standard documentation and linting tools from official package registries.
- Evidence: Reference files suggest installing packages such as
pydocstyle,interrogate,linkchecker,broken-link-checker, andeslint-plugin-jsdocusing pip and npm. - [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface due to its core functionality of executing code examples found in source files.
- Ingestion points: The agent reads and processes external source code and documentation files to generate and validate docstrings (SKILL.md).
- Boundary markers: None provided to separate untrusted code data from agent instructions.
- Capability inventory: The skill executes shell commands (e.g., doctest, pytest) to verify code examples found within the ingested documentation.
- Sanitization: No mechanisms for sandboxing or sanitizing code examples are described before they are passed to execution tools.
Audit Metadata