scaffold-mintlify-site
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local scripts to perform project analysis and utility functions.
- Evidence:
SKILL.mdinstructs the agent to runscripts/detect-project-type.shto determine project capabilities andscripts/check_contrast.pyto validate accessibility of selected brand colors. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the target project root which may contain untrusted content that could influence agent behavior during the scaffolding process.
- Ingestion points: The script
scripts/detect-project-type.shreads project metadata frompyproject.tomlandpackage.json, and performs recursive grep searches through thesrc/directory to detect MCP server implementations or API definitions. - Boundary markers: Absent. The skill does not explicitly use delimiters or guardrails when processing the content found in the project's source code or configuration files.
- Capability inventory: The skill has the capability to create a new directory tree (
docs-mintlify/), write multiple MDX and JSON files, and append content to the project's rootMakefile. - Sanitization: Absent. The detection script's output is used directly to determine the documentation's Information Architecture (IA) and navigation groups.
Audit Metadata