docs-sync
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill utilizes command-line tools like
rg(ripgrep) to search for implementation details andpnpm -F docs-code build-checkto verify that code snippets in the documentation are compilable. These operations are standard for documentation synchronization tasks and are restricted to the local repository environment. - External Knowledge Integration: To maintain accuracy, the skill can invoke the OpenAI Developer Docs MCP server (
$openai-knowledge) andDeepwiki MCP. These are used as supplementary references to ensure the documentation aligns with platform features and are consistent with the skill's purpose. - Indirect Prompt Injection Surface: The skill processes untrusted data from the repository (source code and existing documentation) to identify gaps.
- Ingestion points: The agent reads from
packages/anddocs/src/content/docsto build a feature inventory. - Boundary markers: The workflow mandates classification against "Documentation Change Verification Tiers" in
AGENTS.mdand requires specific verification steps based on the tier. - Capability inventory: The skill can execute file searches, Git inspections, and local build commands.
- Sanitization: Verification is performed via the
build-checkcommand, which ensures that proposed code changes are valid TypeScript/TSX.
Audit Metadata