gathering-documentation

Pass

Audited by Gen Agent Trust Hub on Apr 4, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: No security issues detected. The skill provides legitimate workflows for documentation research and organization using standard developer tools.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes the playwright Node.js package for browser automation. Playwright is a well-known and widely used library for the functionality described in the skill.
  • [PROMPT_INJECTION]: The documentation gathering process involves ingesting untrusted content from external websites, creating a surface for potential indirect prompt injection.
  • Ingestion points: Data enters the context via webFetch calls in SKILL.md and the scraping logic in scripts/doc-crawler.js.
  • Boundary markers: No explicit markers or "ignore instructions" warnings are present in the extraction prompts.
  • Capability inventory: The skill has the capability to write files to the local directory and perform network requests through the automated browser.
  • Sanitization: The skill extracts specific HTML elements but does not explicitly sanitize the text content for embedded instructions before summarization.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 4, 2026, 01:44 PM
Security Audit — agent-trust-hub — gathering-documentation