skill-doc-sync
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard system utilities such as
find,grep, andsed, along with version control toolsgitand theghCLI. These tools are used to identify changed files, extract version information, and manage the documentation commit process. These operations are aligned with the skill's primary documentation synchronization purpose. - [INDIRECT_PROMPT_INJECTION]: The skill processes project-controlled markdown files and git diff output as input for documentation updates, creating a surface for indirect prompt injection.
- Ingestion points: Project-level
.mdfiles,package.json, and the output ofgit diffcommands. - Boundary markers: None explicitly defined in the bash scripts to delimit external content from instructions.
- Capability inventory: The skill has the ability to modify local files, stage changes (
git add), and create new commits (git commit). - Sanitization: No automated sanitization is implemented; however, the skill instructions explicitly mandate human review for updates to sensitive sections like security models and philosophy headers.
Audit Metadata