undocs
Pass
Audited by Gen Agent Trust Hub on Feb 15, 2026
Risk Level: LOW
Full Analysis
- SAFE (INFO): The skill contains no executable code, binary files, or active scripts. All 25 files are markdown-based documentation or metadata. No malicious patterns such as obfuscated code, credential harvesting, or prompt injection were identified.
- COMMAND_EXECUTION (LOW): The documentation describes various CLI commands (e.g.,
npx undocs dev,npx undocs build) and package manager operations. These are standard development instructions for the tool being documented and do not constitute a malicious attempt to hijack the agent's environment. - EXTERNAL_DOWNLOADS (LOW): The documentation references external tools like
undocs,giget, andnuxt. While these are not in the predefined 'Trusted Sources' list, they are well-known open-source projects within the UnJS/Nuxt ecosystem. The references are informational and standard for technical manuals. - DATA_EXFILTRATION (INFO): The skill mentions endpoints like
/raw/*.mdand/llms.txt, which are designed to expose documentation content to LLMs and CLI tools (viacurlorAcceptheaders). These are documented features for documentation accessibility and do not involve sensitive user data exposure.
Audit Metadata