docs-and-website-sync
Pass
Audited by Gen Agent Trust Hub on May 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill's behavior is consistent with its stated purpose of synchronizing documentation, websites, and AI skills with the project's source code.\n- [COMMAND_EXECUTION]: The skill utilizes local development tools through
pnpm(e.g.,pnpm exec eslint,pnpm build) to validate and build documentation assets. These commands are standard for the project's ecosystem and do not involve untrusted remote execution.\n- [DATA_EXFILTRATION]: While the skill reads internal source files and configuration data (e.g.,packages/weapp-vite/src/types/config/**), this access is restricted to the local repository for synchronization purposes. No network exfiltration or unauthorized access to sensitive files (e.g., credentials) was found.\n- [PROMPT_INJECTION]: The skill processes local source files as facts for documentation updates. Although these files are inputs, the skill's design focuses on data extraction rather than instruction execution, significantly mitigating the risk of indirect prompt injection.
Audit Metadata