docusaurus-generator
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS] (LOW): The skill installs create-docusaurus and @easyops-cn/docusaurus-search-local via npx and npm. While create-docusaurus is a standard tool from a trusted ecosystem, the search plugin is a third-party community dependency.
- [COMMAND_EXECUTION] (SAFE): Shell commands used for project analysis and site building (find, ls, npm, npx) are standard and appropriate for the skill's primary purpose.
- [PROMPT_INJECTION] (LOW): The skill has an attack surface for Indirect Prompt Injection (Category 8) due to reading local project files.
- Ingestion points: SKILL.md reads project metadata and content from package.json and various markdown files in Step 1.
- Boundary markers: Absent. The skill does not instruct the agent to disregard instructions potentially embedded within the analyzed project files.
- Capability inventory: The skill executes shell commands (npm, npx) and performs file system operations.
- Sanitization: Absent. Content from analyzed files is not sanitized or escaped before being used to influence the documentation generation process.
Audit Metadata