wiki-generator
Pass
Audited by Gen Agent Trust Hub on Mar 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's
wiki/index.htmlfile fetches the Docsify engine, Mermaid diagramming library, and Tailwind CSS from well-known content delivery networks includingcdn.jsdelivr.netandcdn.tailwindcss.com. These are used to provide a rich local preview of the generated documentation and are considered safe, established services. - [COMMAND_EXECUTION]: The skill provides a mechanism to preview the generated Wiki via a local shell script located at
.cursor/skills/wiki-generator/scripts/serve-wiki.sh. This script is intended to be executed within the local developer environment to serve the static documentation files. - [DATA_EXPOSURE]: To perform its primary function, the skill analyzes local project metadata and source code, including
package.json,vite.config.ts, and files within thesrc/directory. This data access is necessary to extract architectural information for the Wiki and is confined to the local filesystem. - [PROMPT_INJECTION]: An indirect prompt injection surface exists because the skill ingests data from external source code to generate documentation. While the skill has file-write capabilities to produce the Wiki, this behavior is a core component of its functional design for local documentation management.
- Ingestion points: Reads project source code and configuration files (
package.json,vite.config.ts) from the local repository. - Boundary markers: No specific boundary markers are identified in the instructions for isolating ingested code content within the output Markdown files.
- Capability inventory: Possesses file-write access to create and update documentation in the
.wiki/directory and executes a local preview script. - Sanitization: No explicit sanitization or filtering of source code content is performed prior to Wiki generation.
Audit Metadata