docmap
Pass
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the
@paleo/docmappackage from the NPM registry as a development dependency. This resource is provided by the skill's author to support documentation workflows. - [COMMAND_EXECUTION]: The skill uses shell commands and package managers to perform documentation tasks, including:
- Installing tools and managing
package.jsonscripts. - Using the
docmapCLI to list, validate, and read documents. - Creating, renaming, and deleting files and directories during documentation migration.
- Updating project files like
AGENTS.mdto incorporate documentation discovery into the agent's operating instructions. - [PROMPT_INJECTION]: The skill involves reading and processing external data from documentation files and other agent skills, which presents an attack surface for indirect prompt injection where malicious instructions in the data could influence the agent.
- Ingestion points: Markdown files in the
docs/directory and various agent skill directories (e.g.,.claude/skills/). - Boundary markers: The
docmapCLI strips frontmatter when reading files, and the skill defines specific conventions for content organization. - Capability inventory: The agent has access to shell command execution, file system modifications (write, rename, delete), and project configuration updates.
- Sanitization: The instructions require that all file and directory names are "shell-safe" and follow kebab-case conventions, which are validated by the
docmap --checkcommand.
Audit Metadata