developer-tutorial
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill consists of instructional markdown files and documentation templates. It does not include any executable scripts, binaries, or automated shell commands that would compromise the host system.
- [SAFE]: The skill references other specialized skills from the same author, such as
samber/developer-relations-skills@developer-quickstart-guideandsamber/developer-relations-skills@technical-video-script. These are handled as legitimate internal resource pointers for routing different content types. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-provided descriptions of software products to create tutorials, which introduces a surface for indirect prompt injection. However, the risk is negligible as the agent's output is restricted to text generation and it lacks dangerous capabilities like file system manipulation or network exfiltration.
- Ingestion points: User-provided learning objectives, audience levels, and product descriptions (SKILL.md).
- Boundary markers: The skill uses a structured 'Interview' process to collect data but does not employ specific delimiters to isolate user-supplied content from instructions.
- Capability inventory: Generation of software configuration files, source code snippets in various languages (JavaScript, Python), and shell commands (references/worked-examples.md, references/tutorial-outline-template.md).
- Sanitization: No explicit sanitization, validation, or escaping of user-provided technical details is defined in the instructions.
Audit Metadata