okf-bundle
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill performs documentation maintenance tasks entirely locally using the Python standard library. Analysis confirms no network activity, external data transmission, or hardcoded credentials.\n- [COMMAND_EXECUTION]: The skill defines a workflow involving the execution of Python scripts (
okf_validate.py,okf_index.py) to process local files. These scripts are implemented using standardargparseandpathlibmodules and do not incorporate dangerous execution patterns or shell injection vulnerabilities.\n- [DATA_EXFILTRATION]: All data processing remains local. The code does not use network-capable modules such assocket,http, orurllib, and does not integrate with any external APIs.\n- [PROMPT_INJECTION]: The skill instructions and metadata are focused on documentation standards and do not contain patterns aimed at overriding agent safety filters. While the skill processes untrusted markdown data to generate indices, it includes sanitization to maintain structural integrity.\n - Ingestion points: Markdown files read from the local
bundle_rootdirectory via theiter_concept_filesfunction.\n - Boundary markers: No explicit markers are used to delimit external content in the generated output.\n
- Capability inventory: Local file system read and write operations restricted to the provided bundle root via
pathlib.\n - Sanitization: Employs an
_md_escapefunction to escape pipe characters within generated markdown tables.
Audit Metadata