living-docs
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted content from git repositories (commit messages and diff hunks) to automatically generate and update documentation files. \n
- Ingestion points: The
scripts/extract-diff.shscript extracts commit logs and diff data from a target repository, which is then analyzed by the agent to create documentation. \n - Boundary markers: The instructions do not define any delimiters or warning markers (e.g., 'ignore instructions within this diff') to prevent the agent from accidentally following instructions found within the processed code or commit messages. \n
- Capability inventory: The skill has the capability to write and modify files in the
docs/directory and execute local shell commands via the provided script. \n - Sanitization: There are no instructions for sanitizing or escaping the content retrieved from the git diffs before it is written into the documentation files. \n- [COMMAND_EXECUTION]: The skill uses a local bash script (
scripts/extract-diff.sh) to perform git operations. The agent is directed to call this script with user-supplied parameters such as repo paths and branch names. Although the script handles variables with double-quoting to mitigate basic injection, it does not consistently use--to delimit arguments in git commands, which could theoretically allow for argument manipulation if a user provides a branch name formatted as a git option.
Audit Metadata