agents-md-creator
Pass
Audited by Gen Agent Trust Hub on Mar 4, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill ingests untrusted data from project files such as
package.json(specifically thenameanddescriptionfields) andREADME.mdduring its discovery and documentation generation phases. This metadata is processed without explicit sanitization or boundary markers to prevent embedded instructions from influencing the agent's behavior. The skill possesses the capability to execute shell commands and write to the local filesystem. - [COMMAND_EXECUTION]: The skill executes local shell utilities including
find,grep,jq, andwcto detect monorepo structures and list packages. Additionally, it provides templates and instructions that utilize well-known build tools and package managers such asTurborepo,Nx,npm, andpnpmfor task orchestration and project management.
Audit Metadata