Skills docs-sources

📦

docs-sources

Name: docs-sources
Author: Consiliency

Content revision r1 Medium Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Choose Reliable Documentation Fetch Strategies

Documentation sites expose content through different platforms and formats. This skill identifies the source type and recommends a practical fetch and registry strategy.

Supports: Claude Codex Code(CC)

📊 69 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "docs-sources" from https://skillstore.io/skills/consiliency-docs-sources.md and its manifest at https://skillstore.io/api/skills/consiliency-docs-sources/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/consiliency-docs-sources.md Signed manifest GET /api/skills/consiliency-docs-sources/manifest Signed lockfile GET /api/skills/consiliency-docs-sources/lockfile

Test it

Using "docs-sources". Choose a strategy for a site that publishes llms.txt.

Expected outcome:

Recommended strategy: llms.txt.
Reason: the source is already optimized for language model consumption.
Fallback: use repository content, then a sitemap, if coverage is incomplete.

Using "docs-sources". Assess documentation built from a public Docusaurus repository.

Expected outcome:

Recommended strategy: GitHub raw content.
Detection evidence: Docusaurus config and sidebar files are present.
Registry guidance: record the repository, branch, documentation path, and navigation config.

Using "docs-sources". Plan ingestion for a JavaScript-rendered documentation site.

Expected outcome:

Try llms.txt, repository content, API specifications, and the sitemap first.
Use browser automation only when direct requests return incomplete shell content.
Restrict navigation to approved public origins and apply crawl limits.

Security Audit

Medium Risk

v9 • 7/13/2026 Open versioned report

The audit confirms two medium risks: nested sitemap fetching and browser link navigation can reach attacker-selected destinations. Other alerts are safe examples, Markdown formatting, fixed URLs, localhost checks, or harmless redirection; no prompt injection was found.

Files scanned

1,514

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

cookbook/browser-strategy.md:81-86

Unchecked Browser Link Navigation

The browser workflow follows extracted links without scheme, origin, or private-network validation. A hostile documentation page can direct requests to unintended destinations.

Lines 81-86 pass each extracted link to the navigation wrapper. The workflow contains no destination validation step.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

cookbook/sitemap-strategy.md:52

xargs command (can execute arbitrary commands)

xargs -I{} curl -s "{}" | grep -oP '(?<=<loc>)[^<]+'

The command sends URLs extracted from a remote sitemap directly to curl without scheme, host, or private-network validation. A hostile sitemap can trigger unintended requests.

Risk Factors

⚙️ External commands (45)

🌐 Network access (50)

📁 Filesystem access (1)

cookbook/sitemap-strategy.md:29

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/consiliency-docs-sources/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/consiliency-docs-sources/security.svg)](https://skillstore.io/skills/consiliency-docs-sources?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/consiliency-docs-sources?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/consiliency-docs-sources/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/consiliency-docs-sources.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Consiliency. (2026). docs-sources security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/consiliency-docs-sources/audits/9

BibTeX citation

@techreport{consiliency-consiliency-docs-sources-2026,
  author = {Consiliency},
  title = {docs-sources security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/consiliency-docs-sources/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "docs-sources security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "Consiliency"
date-released: "2026-07-13"
url: "https://skillstore.io/skills/consiliency-docs-sources/audits/9"
identifiers:
  - type: other
    value: "skillstore:consiliency-docs-sources:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Add a documentation source

Detect the source platform, select a fetch strategy, and prepare a registry entry for a development team.

Migrate documentation ingestion

Compare raw repository content, structured specifications, sitemaps, and browser fetching before changing an ingestion pipeline.

Complete an AI documentation registry

Match detected project libraries to missing documentation sources and prioritize additions.

Try These Prompts

Choose a fetch strategy

Analyze documentation at {url}. Check source signals and recommend one fetch strategy with concise evidence.

Configure one source

Prepare a registry entry for {library} at {url}. Detect its framework and specify the strategy, source paths, priority, and filters.

Compare source options

Compare llms.txt, repository, API specification, sitemap, and browser options for {project}. Rank them by completeness, reliability, and maintenance cost.

Design a resilient rollout

Design a documentation ingestion plan for {projects}. Include detection evidence, primary and fallback strategies, validation controls, rate limits, and registry updates.

Best Practices

Check AI-native and raw repository sources before crawling rendered pages.
Validate every remote destination and restrict crawls to approved public origins.
Record detection evidence and test the selected strategy before updating the registry.

Avoid

Do not launch browser automation before testing simpler direct-fetch methods.
Do not follow sitemap or page links without scheme, host, and network-range validation.
Do not add registry entries without confirming framework signals and source paths.