documentation-generation-doc-generate
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and extract information from local codebase components such as code, comments, and configuration files. This creates a surface for indirect prompt injection where malicious instructions embedded in comments could influence the agent's behavior.
- Ingestion points: The skill ingests codebase content via the
APIDocExtractor,DocCoverage, and other analysis scripts that read local files. - Boundary markers: No explicit delimiters are used in the prompt templates to separate user-provided code from the agent's core instructions.
- Capability inventory: The skill has access to the local filesystem and can generate shell commands for documentation builds and CI/CD pipelines.
- Sanitization: The skill contains instructions to avoid exposing secrets but does not include programmatic sanitization for embedded prompt instructions.
- [EXTERNAL_DOWNLOADS]: The skill's resources reference external libraries and tools from well-known and trusted sources.
- Fetches
swagger-ui-distfromjsdelivr, a well-known CDN service. - References official GitHub Actions from the
actionsorganization for environment setup. - Specifies the installation of standard documentation tools such as
@redocly/cliandsphinx. - [COMMAND_EXECUTION]: The implementation playbook includes templates for shell commands to automate documentation workflows.
- Includes standard package management commands like
pip installandnpm install. - Includes build commands for documentation generation like
sphinx-buildandredocly build-docs.
Audit Metadata