write-coding-standards-from-file
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches content from a large list of external technical documentation and style guide URLs (e.g., Microsoft, Google, GitHub, Python.org, and various community-run style guides) to use as context for generating standards. While most targets are well-known technical references, the skill performs network operations to these sites when the
fetchStyleURLparameter is enabled. - [COMMAND_EXECUTION]: The skill performs file system operations, including creating new files (e.g.,
STYLE.md,CODING_STANDARDS.md), writing new test files whenaddStandardsTestis true, and modifying the existingREADME.mdfile by inserting generated content at various positions. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection:
- Ingestion points: The skill reads and processes the content of local files and folders provided in
${fileName}and${folderName}, as well as external content fetched from style guide URLs. - Boundary markers: None are specified to distinguish between the skill's instructions and the untrusted content being analyzed.
- Capability inventory: The skill has the capability to write new files to the repository, modify existing documentation (
README.md), and perform network fetches. - Sanitization: No sanitization or validation of the analyzed file content is mentioned. Maliciously crafted source code could potentially influence the agent's logic during the analysis and generation phase.
Audit Metadata