deepinit
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The core functionality of traversing a codebase and generating documentation is a standard developer workflow. The skill ignores sensitive directories like node_modules and .git by default.
- [COMMAND_EXECUTION]: The skill utilizes common Unix utilities such as 'find' and 'grep' for the purpose of validating the hierarchical integrity of the generated documentation. These commands are used in a benign, read-only manner.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it summarizes content from untrusted files into AGENTS.md files, which are intended to provide instructions to AI agents. * Ingestion points: The skill reads all files within analyzed directories during Step 3 of its workflow. * Boundary markers: The output template uses standard headers but does not implement explicit boundary markers or warnings to ignore instructions contained within the summarized source code. * Capability inventory: The skill has permissions to write and delete AGENTS.md files across the codebase. * Sanitization: There is no specification for filtering or sanitizing file content before incorporating summaries into the generated documentation.
Audit Metadata