tldr-code

Pass

Audited by Gen Agent Trust Hub on Mar 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to run the tldr command-line utility for various code analysis tasks, including searching, extracting code structures, and managing a background daemon for query caching.
  • [EXTERNAL_DOWNLOADS]: The semantic search feature (tldr semantic index) fetches external AI models like bge-large-en-v1.5 or all-MiniLM-L6-v2 from remote repositories when first initialized.
  • [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface through its code analysis functions. 1. Ingestion points: Reads source code and documentation from the filesystem (e.g., via tldr extract, tldr search). 2. Boundary markers: Absent; there are no specified markers to separate tool output from instructions. 3. Capability inventory: Access to the Bash tool for command execution. 4. Sanitization: None; external code content is processed and presented to the agent without filtering.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 23, 2026, 09:04 AM
Security Audit — agent-trust-hub — tldr-code