ln-100-documents-pipeline
Pass
Audited by Gen Agent Trust Hub on Apr 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches shared references and configuration files from the author's official GitHub repository (
levnikolaevich/claude-code-skills) using theWebFetchtool if local directories are not detected. - [COMMAND_EXECUTION]: Executes a local JavaScript tool (
shared/scripts/docs-quality/cli.mjs) using thenoderuntime to perform automated quality checks and generate documentation manifests. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests and processes untrusted repository files like
README.mdandCONTRIBUTING.mdto extract facts for document generation. - Ingestion points: Project documentation files scanned during the legacy detection phase (Phase 0).
- Boundary markers: While the skill mentions a quality gate (Phase 3) and verification steps, it does not explicitly define the use of delimiters or 'ignore' instructions for the extracted content inside prompts.
- Capability inventory: Includes the ability to execute shell commands via
node, modify the file system viaEdit, and orchestrate other skills using theSkilltool. - Sanitization: Implements a quality verification phase that uses a verifier script to detect forbidden placeholders, broken links, and metadata leaks.
Audit Metadata