code-tour
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes two bundled Python scripts,
validate_tour.pyandgenerate_from_docs.py, to assist the agent in creating and verifying walkthrough files. These scripts are executed locally, use standard Python libraries, and are focused on JSON validation and text parsing of repository documentation. - [EXTERNAL_DOWNLOADS]: The documentation includes references to real-world examples and search queries hosted on GitHub (
github.comandraw.githubusercontent.com). These are used to fetch static JSON examples for the agent to reference, and target well-known, trusted domains for developer documentation. - [DATA_EXFILTRATION]: The skill is designed to read repository content, such as source code, README files, and configuration files, to generate accurate technical descriptions. This data access is restricted to the local environment and is necessary for the skill's primary function of documenting the codebase.
- [PROMPT_INJECTION]: The skill processes untrusted content from the repository (READMEs and source code) to generate descriptions for the tours.
- Ingestion points: README.md, CONTRIBUTING.md, and various source files across the repository.
- Boundary markers: None explicitly defined for interpolated data, though instructions require adherence to a strict JSON schema.
- Capability inventory: Execution of bundled Python scripts and writing JSON files to the filesystem.
- Sanitization: The skill relies on the agent's reasoning to fill template fields and validate the output using the provided script.
Audit Metadata