get-api-docs
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to install the
chubtool vianpmand to perform operations such as searching (chub search), fetching (chub get), and annotating (chub annotate) documentation. - [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the
@aisuite/chubpackage from the public npm registry. This package is the primary tool for the skill's documented purpose. - [INDIRECT_PROMPT_INJECTION]: The agent processes documentation fetched from an external source via the
chubCLI, which introduces a potential surface for indirect prompt injection if the source content is untrusted. - Ingestion points: Documentation content retrieved through the
chub getcommand as described inSKILL.md. - Boundary markers: The instructions do not specify the use of delimiters or "ignore" instructions when processing the fetched documentation.
- Capability inventory: The skill possesses the capability to execute shell commands and install software (npm).
- Sanitization: No explicit sanitization or validation logic is defined for the content retrieved from the external documentation service.
Audit Metadata