scaffold-mintlify-site

Pass

Audited by Gen Agent Trust Hub on Nov 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local scripts to perform project analysis and utility functions.
  • Evidence: SKILL.md instructs the agent to run scripts/detect-project-type.sh to determine project capabilities and scripts/check_contrast.py to validate accessibility of selected brand colors.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the target project root which may contain untrusted content that could influence agent behavior during the scaffolding process.
  • Ingestion points: The script scripts/detect-project-type.sh reads project metadata from pyproject.toml and package.json, and performs recursive grep searches through the src/ directory to detect MCP server implementations or API definitions.
  • Boundary markers: Absent. The skill does not explicitly use delimiters or guardrails when processing the content found in the project's source code or configuration files.
  • Capability inventory: The skill has the capability to create a new directory tree (docs-mintlify/), write multiple MDX and JSON files, and append content to the project's root Makefile.
  • Sanitization: Absent. The detection script's output is used directly to determine the documentation's Information Architecture (IA) and navigation groups.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 1, 2026, 08:56 PM