code-documenter

Pass

Audited by Gen Agent Trust Hub on Jun 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute various shell commands to validate the integrity of documentation and code examples.
  • Evidence: Use of python -m doctest, pytest --doctest-modules, tsc --noEmit, and npx @redocly/cli lint for code and specification validation in SKILL.md.
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing standard developer tools and documentation frameworks from well-known registries.
  • Evidence: Instructs the agent to use pip install for packages like pydocstyle, interrogate, and linkchecker, and npm install or npx for tools like create-docusaurus, @redocly/cli, and broken-link-checker (SKILL.md, references/coverage-reports.md, references/documentation-systems.md).
  • [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes local source code to generate and validate documentation.
  • Ingestion points: Reads local code files to identify undocumented functions and classes (SKILL.md).
  • Boundary markers: Absent; the skill relies on standard agent context management for reading files.
  • Capability inventory: The agent is instructed to run commands like doctest and pytest, which execute code snippets embedded in documentation blocks (SKILL.md).
  • Sanitization: Absent; the skill workflow assumes the provided project code is a trusted source during the documentation process.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 21, 2026, 05:08 PM
Security Audit — agent-trust-hub — code-documenter