documenso-debug-bundle
Pass
Audited by Gen Agent Trust Hub on Apr 27, 2026
Risk Level: SAFE
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic context injection syntax (
!command) to retrieve and display the versions of Node.js and Python, as well as basic system architecture information. These are benign environment discovery commands intended for technical support context. - [COMMAND_EXECUTION]: The skill provides utility scripts that use shell tools like
curlandjqto verify authentication and connectivity with the official Documenso API endpoints. It also utilizesnpx tsxto run TypeScript diagnostic scripts. - [DATA_EXPOSURE]: Contains a debug logging wrapper that proxies API calls and logs truncated request arguments to the console. While this facilitates troubleshooting, it is correctly documented with advice for users to sanitize logs before sharing them in support tickets.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external API responses (such as document titles and statuses). This represents a standard injection surface; however, the skill processes this data for logging and reporting without unsafe interpolation into agent instructions.
Audit Metadata