lc-faq-add
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions define a workflow for document maintenance within a local development environment. It leverages standard shell utilities (ls, grep, sed, bash) and project-specific scripts (node script/zh.js, site/build.sh) to perform its tasks. All file operations are scoped to the project's documentation directories (doc/faq/ and i18n/zh/faq/).
- [EXTERNAL_DOWNLOADS]: The skill references an external repository (github.com/yennanliu/CS_basics) for translation guidelines. As this repository belongs to the skill's author, it is considered a vendor-owned resource. No other external connections or downloads from untrusted sources were identified.
- [COMMAND_EXECUTION]: The skill uses tools like Bash and Node.js to run local build and testing commands (e.g., npm test, site/build.sh). These are standard practices for documentation and software development workflows and do not involve privilege escalation or suspicious execution patterns.
- [INDIRECT_PROMPT_INJECTION]: The skill involves reading existing markdown files to identify 'Scope' lines and heading structures. While this presents a theoretical ingestion surface for data-resident instructions, the skill's operational context (local repository maintenance) and the lack of automated network triggers make this a standard functional requirement rather than a security risk.
Audit Metadata