doc-gen
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx @claude-flow/cli@latest, which downloads and executes the latest version of the CLI tool from the npm registry at runtime. - [COMMAND_EXECUTION]: Executes shell commands via
npxto trigger documentation workers with specific scopes (api,full). - [PERSISTENCE]: Utilizes the
CronCreatetool to schedule recurring execution of documentation workers every 2 hours (0 */2 * * *). - [INDIRECT_PROMPT_INJECTION]: The skill processes project code to detect documentation drift. This creates a vulnerability surface where instructions embedded in the analyzed code or existing documentation could influence the agent's behavior.
- Ingestion points: Local project code and documentation files.
- Boundary markers: None specified in the instructions.
- Capability inventory: Shell execution (
Bash), file writing (Write), and task scheduling (CronCreate). - Sanitization: No explicit sanitization of code content before processing is mentioned.
Audit Metadata