docs-sync

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • Command Execution: The skill utilizes command-line tools like rg (ripgrep) to search for implementation details and pnpm -F docs-code build-check to verify that code snippets in the documentation are compilable. These operations are standard for documentation synchronization tasks and are restricted to the local repository environment.
  • External Knowledge Integration: To maintain accuracy, the skill can invoke the OpenAI Developer Docs MCP server ($openai-knowledge) and Deepwiki MCP. These are used as supplementary references to ensure the documentation aligns with platform features and are consistent with the skill's purpose.
  • Indirect Prompt Injection Surface: The skill processes untrusted data from the repository (source code and existing documentation) to identify gaps.
  • Ingestion points: The agent reads from packages/ and docs/src/content/docs to build a feature inventory.
  • Boundary markers: The workflow mandates classification against "Documentation Change Verification Tiers" in AGENTS.md and requires specific verification steps based on the tier.
  • Capability inventory: The skill can execute file searches, Git inspections, and local build commands.
  • Sanitization: Verification is performed via the build-check command, which ensures that proposed code changes are valid TypeScript/TSX.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 05:41 PM