finding-sbx-docs
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads documentation files from Docker's official website (docs.docker.com) and GitHub repository (github.com/docker/docs). These sources are well-known technology providers, and the downloads are consistent with the skill's primary purpose of mirroring technical documentation.
- [COMMAND_EXECUTION]: The skill includes shell and Python scripts (
fetch-docs.sh,relink-docs.py) designed to manage the local documentation mirror. These scripts perform file system management, network requests viacurlto fetch documentation, and regex-based text processing to localize links within the mirrored markdown files. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data in the form of mirrored documentation.
- Ingestion points: Files located in
references/docs/downloaded from Docker's infrastructure. - Boundary markers: The skill does not explicitly use boundary markers for the ingested text, but instructs the agent to read the pages to verify specific claims.
- Capability inventory: The skill uses
curlfor fetching andpython3for processing, as well as recommending local command execution (sbx --version) for verification. - Sanitization: The
relink-docs.pyscript performs basic sanitization by stripping navigation breadcrumbs and rewriting absolute URLs to relative local paths.
Audit Metadata