code-documenter
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute various shell commands to validate the integrity of documentation and code examples.
- Evidence: Use of
python -m doctest,pytest --doctest-modules,tsc --noEmit, andnpx @redocly/cli lintfor code and specification validation in SKILL.md. - [EXTERNAL_DOWNLOADS]: The skill recommends installing standard developer tools and documentation frameworks from well-known registries.
- Evidence: Instructs the agent to use
pip installfor packages likepydocstyle,interrogate, andlinkchecker, andnpm installornpxfor tools likecreate-docusaurus,@redocly/cli, andbroken-link-checker(SKILL.md, references/coverage-reports.md, references/documentation-systems.md). - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes local source code to generate and validate documentation.
- Ingestion points: Reads local code files to identify undocumented functions and classes (SKILL.md).
- Boundary markers: Absent; the skill relies on standard agent context management for reading files.
- Capability inventory: The agent is instructed to run commands like
doctestandpytest, which execute code snippets embedded in documentation blocks (SKILL.md). - Sanitization: Absent; the skill workflow assumes the provided project code is a trusted source during the documentation process.
Audit Metadata