features-documentation

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes local shell commands including git diff, find, grep, and sed to detect feature changes and verify documentation coverage. These commands are used for project analysis and operate on the local file system.
  • [EXTERNAL_DOWNLOADS]: The skill invokes npx markdownlint and npx markdown-link-check to validate documentation files. These are well-known, standard tools in the Node.js ecosystem used for static analysis of markdown files.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes project metadata and code content, creating a potential surface for indirect prompt injection.
  • Ingestion points: File names retrieved via git diff and feature tags extracted from source files (.ts, .tsx) using grep.
  • Boundary markers: None explicitly defined in the provided snippets for the extracted strings.
  • Capability inventory: The agent is instructed to execute local shell commands and invoke a secondary skill (documentation-audit).
  • Sanitization: The skill uses specific regular expressions to target and extract feature strings, which limits the scope of ingested data to expected patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 02:44 PM