claude-project-docs
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [Prompt Injection] (SAFE): No malicious patterns or bypass attempts were detected. The skill follows standard instructional logic for documentation generation.\n- [Data Exposure & Exfiltration] (SAFE): The skill does not access sensitive paths (like .ssh or .aws) or hardcode any credentials. It accesses standard project files (e.g., package.json) for context, which is the intended behavior.\n- [Unverifiable Dependencies & Remote Code Execution] (SAFE): No remote code patterns (curl | bash) or package installations (pip/npm) were found. The skill is entirely instruction-based.\n- [Indirect Prompt Injection] (SAFE): The skill ingests untrusted data from project files (package.json, Makefile, etc.) to generate documentation. While boundary markers are absent, the skill's capabilities are limited to markdown text generation, posing no risk of downstream execution or privilege escalation. Evidence: Ingestion points (package.json, pyproject.toml, go.mod, Makefile), Boundary markers (None), Capability inventory (Markdown writing), Sanitization (None).\n- [Persistence Mechanisms] (SAFE): No attempts to modify system startup files or shell profiles were identified.\n- [Dynamic Execution] (SAFE): No code generation, eval, or runtime compilation occurs within this skill.
Audit Metadata