skill-doc-sync

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes standard system utilities such as find, grep, and sed, along with version control tools git and the gh CLI. These tools are used to identify changed files, extract version information, and manage the documentation commit process. These operations are aligned with the skill's primary documentation synchronization purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes project-controlled markdown files and git diff output as input for documentation updates, creating a surface for indirect prompt injection.
  • Ingestion points: Project-level .md files, package.json, and the output of git diff commands.
  • Boundary markers: None explicitly defined in the bash scripts to delimit external content from instructions.
  • Capability inventory: The skill has the ability to modify local files, stage changes (git add), and create new commits (git commit).
  • Sanitization: No automated sanitization is implemented; however, the skill instructions explicitly mandate human review for updates to sensitive sections like security models and philosophy headers.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 02:21 PM