readme-sync

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses a shell script involving find, grep, sed, and tr to process local files and generate documentation. It also invokes markdownlint-cli via bunx to validate the resulting README.md file.- [INDIRECT_PROMPT_INJECTION]: This skill has a surface for indirect prompt injection as it aggregates content from multiple files into a single document. * Ingestion points: Metadata (descriptions) are read from all SKILL.md files within the skills/ subdirectory. * Boundary markers: The skill does not use any delimiters or warnings to isolate the ingested content within the generated table. * Capability inventory: The skill can read arbitrary files within the specified directory structure and output formatted markdown. * Sanitization: The script performs minimal sanitization (removing quotes and truncating length), which does not protect against malicious markdown or prompt injection payloads embedded in the source descriptions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 02:10 PM