tldr-2
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external content from the tldr-pages community project. An attacker could theoretically contribute a malicious documentation page intended to influence agent behavior when the page is retrieved.
- Ingestion points: The output generated by executing
tldr <command>is incorporated into the agent's context. - Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions for the tool output.
- Capability inventory: The skill allows execution of the
tldrbinary for reading pages and updating the local cache. - Sanitization: No explicit sanitization or filtering is applied to the retrieved documentation content.
- [EXTERNAL_DOWNLOADS]: The command
tldr --updateis used to fetch documentation updates from the official tldr-pages repository on GitHub.
Audit Metadata