harness-step2-fill-docs
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data by reading the local codebase, including source files, configuration files (package.json, pyproject.toml), and existing documentation, to generate new documentation content. This creates a surface where malicious instructions embedded in project files could influence the agent's output during the document generation process.
- Ingestion points: Reads project files using
cat,grep,rg, andfindinSKILL.md(Steps 1 through 6). - Boundary markers: The skill provides structured Markdown templates and explicitly instructs the agent to mark uncertain information as "待补充" (pending) or "TODO".
- Capability inventory: The agent utilizes
ls,find,cat,grep, andrgto read the filesystem and writes the generated content to files within thedocs/directory. - Sanitization: The skill relies on the agent's internal language processing; there is no explicit step to sanitize or escape the content gathered from the codebase before interpolation into the documentation templates.
- [COMMAND_EXECUTION]: The skill uses multiple shell commands (
ls,find,cat,grep,rg) to gather information about the project. These commands are directed at project files and directory structures, which are considered untrusted inputs.
Audit Metadata