render-puzzle-docs
Pass
Audited by Gen Agent Trust Hub on Mar 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local scripts such as
bash inst/scripts/render_quarto.shand the system binaryquarto.exe. These commands are standard for rendering Quarto-based documentation within a local development workflow.\n- [PROMPT_INJECTION]: The skill ingests.qmdfiles from thequarto/directory which can contain executable code blocks. This constitutes an indirect prompt injection surface as there are no explicit boundary markers or sanitization, and the skill has shell execution capabilities. This risk is inherent to the documentation tool's function.\n- [SAFE]: The skill does not perform network requests to untrusted domains, use obfuscation, or attempt privilege escalation. Its operations are consistent with the stated purpose and the author's development environment.
Audit Metadata