skill-doc-generator
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary function is to read SKILL.md files and generate README.md files. This is handled entirely through local script execution.
- [DATA_EXPOSURE_AND_EXFILTRATION]: Analysis of the scripts (
analyze_skill.py,generate_readme.py, etc.) confirms that file access is restricted to the targeted skill directories. No hardcoded credentials or network exfiltration patterns were found. - [REMOTE_CODE_EXECUTION]: The skill does not download external scripts or execute code from untrusted sources. All Python scripts are bundled with the skill and use standard libraries.
- [DYNAMIC_EXECUTION]: The skill uses
yaml.safe_load()to parse frontmatter, which is the recommended practice for preventing arbitrary code execution during YAML deserialization. - [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface for untrusted data (reading SKILL.md files). While it interpolates this data into generated README files, it does not use an LLM for generation, and its capabilities are limited to local file system writes of documentation. The risk is assessed as minimal and consistent with the skill's utility.
Audit Metadata