update-project-docs

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:37 AM UTC
• Version: 1.0.3

Overview

This skill is a documentation-updating workflow with disclosed repository reads and documentation edits, but users should review its generated Docsify template before publishing it.

Install only if you want an agent to inspect your repository and update documentation. Before publishing any scaffolded Docsify site, consider pinning dependencies to exact HTTPS URLs, adding integrity checks, or vendoring reviewed assets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:376

Finding

Unpinned Executable CDN Dependencies Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 376 and 392–394
Vulnerability Type: Insecure third-party dependencies
Risk Level: Medium

Vulnerable Code

html

<link rel="stylesheet" href="//cdn.jsdelivr.net/npm/docsify@4/lib/themes/vue.css">
<script src="//cdn.jsdelivr.net/npm/docsify@4"></script>
<script src="//cdn.jsdelivr.net/npm/docsify/lib/plugins/search.min.js"></script>
<script src="//cdn.jsdelivr.net/npm/prismjs@1/components/prism-bash.min.js"></script>

Technical Analysis

The default Docsify scaffold directs generated documentation sites to load executable JavaScript and CSS from external CDN paths. Some paths are unversioned, while others pin only a major version. These resources can therefore change after the skill and generated site have been reviewed.

The tags do not include Subresource Integrity hashes, so browsers cannot verify that downloaded assets match an audited version. The URLs are also protocol-relative rather than explicitly requiring HTTPS. If an upstream package, release process, CDN account, or mutable distribution path is compromised, attacker-controlled JavaScript can be delivered to documentation visitors.

This is classified as T08: Insecure Dependencies because the risk is introduced through mutable, externally hosted third-party components.

Attack Path

1. A user invokes the skill to scaffold a documentation site.
2. The skill generates docs/index.html using the prescribed external resource tags.
3. The documentation site is deployed without replacing or hardening those tags.
4. An attacker compromises an upstream package, CDN distribution path, or relevant release process.
5. A documentation visitor opens the deployed site.
6. The browser retrieves the altered resource because no exact immutable version or integrity hash is enforced.
7. The attacker-controlled script executes in the documentation site's browser origin.

Impact Assessment

Successful exploitation permits arbit ...[truncated 632 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every third-party resource to an exact, reviewed version rather than an unversioned path or major-version range.
• Replace protocol-relative URLs with explicit https:// URLs.
• Add verified Subresource Integrity hashes and crossorigin="anonymous" to externally hosted scripts and stylesheets.
• Prefer vendoring reviewed static assets into the documentation repository where practical.
• Configure a restrictive Content Security Policy that limits script and style sources.
• Document a controlled dependency-update process that includes version review, integrity-hash updates, and validation before deployment.
• Re-audit generated documentation sites when upstream dependencies are intentionally upgraded.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest trigger is excessively broad: activating on vague phrases like 'mentions documentation updates in any project' can cause the skill to run in contexts the user did not clearly intend. Because this skill instructs the agent to inspect the repository, run git commands, and potentially scaffold or modify documentation files, over-triggering increases the chance of unnecessary file reads, writes, or workflow steering in unrelated conversations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The provided HTML template hard-codes <html lang="en">, which imposes a specific language/locale in generated documentation infrastructure. The skill does not offer a user choice or indicate that this locale should be adapted based on project or user preferences.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.