tldr-code
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to run the tldr command-line utility for various code analysis tasks, including searching, extracting code structures, and managing a background daemon for query caching.
- [EXTERNAL_DOWNLOADS]: The semantic search feature (tldr semantic index) fetches external AI models like bge-large-en-v1.5 or all-MiniLM-L6-v2 from remote repositories when first initialized.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface through its code analysis functions. 1. Ingestion points: Reads source code and documentation from the filesystem (e.g., via tldr extract, tldr search). 2. Boundary markers: Absent; there are no specified markers to separate tool output from instructions. 3. Capability inventory: Access to the Bash tool for command execution. 4. Sanitization: None; external code content is processed and presented to the agent without filtering.
Audit Metadata