technical-doc-creator
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of HTML files (
[system]-docs.html) based on user-supplied technical details. Without sanitization instructions, the skill is vulnerable to XSS if a user provides malicious scripts as part of the documentation content. - Ingestion points: User prompts describing API endpoints, system architecture, and code samples (SKILL.md).
- Boundary markers: Absent. The skill does not instruct the agent to use delimiters or ignore embedded instructions within the user-provided content.
- Capability inventory: The skill is designed to perform file system write operations to generate the documentation output (SKILL.md).
- Sanitization: Absent. There are no guidelines to escape HTML entities or validate user-provided strings before they are interpolated into the HTML templates (assets/templates/base_template.html).
Audit Metadata