docs-audit

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local TypeScript scripts (scripts/discover-docs.ts and scripts/report-path.ts) using the bun runtime. These scripts perform repository discovery by invoking shell commands like git ls-files, git log, git diff-tree, and find to extract file metadata and staleness indicators.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes documentation files (Markdown/MDX) from the codebase as part of its audit workflow. This creates a surface for indirect prompt injection if a documented file contains instructions intended to mislead the agent. While the skill includes checklists for the agent to follow, it lacks explicit boundary markers or sanitization for the content it ingests from the documentation files.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 04:00 AM