hugo-to-markdown
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts included in the package to inventory Hugo configurations and validate the converted Markdown output. Evidence: Commands such as
python3 scripts/inventory_hugo_rules.pyandpython3 scripts/check_standard_markdown.pyare used for repository analysis. - [SAFE]: The skill incorporates comprehensive safety rules that explicitly instruct the agent to never execute Hugo templates or Go template expressions, treating content files as untrusted data. Evidence: The 'Safety Rules' section in
SKILL.mdmandates deterministic, offline operation. - [SAFE]: The provided utility scripts implement security controls to protect the user environment. Evidence:
scripts/inventory_hugo_rules.pyincludes asafe_user_pathfunction to prevent path traversal, andscripts/check_standard_markdown.pyscans for and flags sensitive local absolute paths in the output. - [SAFE]: The skill addresses potential indirect prompt injection by defining a clear conversion pipeline. Ingestion points: Local Hugo repository files including content, data, and configuration files. Boundary markers: The skill instructions emphasize treating content as data and forbidding template execution. Capability inventory: Local file system read/write access and execution of provided Python scripts. Sanitization: The provided scripts implement path resolution validation to restrict access to the current workspace.
Audit Metadata