quill
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes source code, README files, and documentation to identify gaps and generate content. If these files contain malicious instructions (e.g., hidden in comments or prose), they could potentially influence the agent's behavior during the analysis or generation phase.
- Ingestion points: Local source files, READMEs, and .env files (referenced in
SKILL.mdandreference/documentation-patterns.md). - Boundary markers: Absent.
- Capability inventory: The agent can modify local files and execute shell commands for auditing.
- Sanitization: Not explicitly mentioned for ingested content.
- [DYNAMIC_EXECUTION]: The documentation provides templates for auditing scripts, such as
scripts/doc-coverage.ts(usingts-morph) andscripts/type-audit.sh, which are intended to be created and executed on the local filesystem to measure documentation health. Evidence:reference/coverage-audit-tools.md. - [EXTERNAL_DOWNLOADS]: The skill recommends the installation and use of various well-known NPM packages and tools for documentation generation and auditing, including
typedoc,swagger-jsdoc,markdown-link-check,type-coverage, andts-morph. Evidence:reference/api-doc-generation.md,reference/coverage-audit-tools.md. - [COMMAND_EXECUTION]: The skill's reference guides include numerous examples of shell commands for installing dependencies, running linters, and executing the provided audit scripts. The agent may be tasked with running these commands to provide the requested coverage reports. Evidence:
reference/coverage-audit-tools.md.
Audit Metadata