code-documenter
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run shell commands to validate documentation and code examples, such as
python -m doctest,pytest, andtsc --noEmit. (SKILL.md)\n- [EXTERNAL_DOWNLOADS]: The skill recommends installing and using third-party tools and libraries from public registries, includingeslint-plugin-jsdoc,pydocstyle, andinterrogate. (references/coverage-reports.md)\n- [REMOTE_CODE_EXECUTION]: The core workflow usesnpxto dynamically download and execute the@redocly/clitool for linting OpenAPI specifications. (SKILL.md)\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it executes automated tests on user-provided source files. Malicious code embedded in docstrings or documentation examples could be executed during the validation phase. (SKILL.md)\n - Ingestion points: User-provided source code files and API specifications.\n
- Boundary markers: None identified for isolating documentation examples during testing.\n
- Capability inventory: Ability to execute shell commands (
python,npx,pytest).\n - Sanitization: No validation or sanitization is performed on code examples before execution.
Audit Metadata