specsfy-monorepo-documentator
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script
collect_monorepo_evidence.pythat utilizessubprocess.runto invokegitcommands. The implementation uses argument lists rather than shell strings, which prevents command injection. - [COMMAND_EXECUTION]: The agent is instructed to run development commands such as
make ebookand project-specific tests to maintain the monorepo's documentation and build integrity. - [DATA_EXFILTRATION]: The skill reads various project files, including
AGENTS.md,package.json, and lock files to collect evidence. It includes a specific evidence policy to avoid the collection of secrets, production data, or internal content without a defined purpose. - [PROMPT_INJECTION]: The skill processes repository files like
AGENTS.mdas ingestion points for documentation. While explicit boundary markers are not present in the prompt, the agent's capabilities (executinggitandmake) are used within a controlled developer context on a verified repository, and the data collection script provides sanitization via structured JSON output.
Audit Metadata