hugo-to-markdown

Pass

Audited by Gen Agent Trust Hub on Jul 3, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local Python scripts included in the package to inventory Hugo configurations and validate the converted Markdown output. Evidence: Commands such as python3 scripts/inventory_hugo_rules.py and python3 scripts/check_standard_markdown.py are used for repository analysis.
  • [SAFE]: The skill incorporates comprehensive safety rules that explicitly instruct the agent to never execute Hugo templates or Go template expressions, treating content files as untrusted data. Evidence: The 'Safety Rules' section in SKILL.md mandates deterministic, offline operation.
  • [SAFE]: The provided utility scripts implement security controls to protect the user environment. Evidence: scripts/inventory_hugo_rules.py includes a safe_user_path function to prevent path traversal, and scripts/check_standard_markdown.py scans for and flags sensitive local absolute paths in the output.
  • [SAFE]: The skill addresses potential indirect prompt injection by defining a clear conversion pipeline. Ingestion points: Local Hugo repository files including content, data, and configuration files. Boundary markers: The skill instructions emphasize treating content as data and forbidding template execution. Capability inventory: Local file system read/write access and execution of provided Python scripts. Sanitization: The provided scripts implement path resolution validation to restrict access to the current workspace.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 3, 2026, 01:07 PM
Security Audit — agent-trust-hub — hugo-to-markdown