Skills when-documenting-code-use-doc-generator

📦

when-documenting-code-use-doc-generator

Name: when-documenting-code-use-doc-generator
Author: DNYoussef

v1.0.0 Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Generate Complete Code Documentation

Codebases often lack current API references, README files, comments, and diagrams. This skill analyzes project structure and produces documentation assets for Claude, Codex, and Claude Code workflows.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "when-documenting-code-use-doc-generator" from https://skillstore.io/skills/dnyoussef-when-documenting-code-use-doc-generator.md and its manifest at https://skillstore.io/api/skills/dnyoussef-when-documenting-code-use-doc-generator/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dnyoussef-when-documenting-code-use-doc-generator.md Signed manifest GET /api/skills/dnyoussef-when-documenting-code-use-doc-generator/manifest Signed lockfile GET /api/skills/dnyoussef-when-documenting-code-use-doc-generator/lockfile

Test it

Using "when-documenting-code-use-doc-generator". A Node.js API project has routes but no API reference.

Expected outcome:

The skill produces an API overview with endpoint summaries, authentication notes, response descriptions, and links to generated documentation files.

Using "when-documenting-code-use-doc-generator". A repository has an outdated README and missing setup instructions.

Expected outcome:

The skill drafts a refreshed README with project overview, prerequisites, installation, usage, testing, configuration, and contribution sections.

Using "when-documenting-code-use-doc-generator". A source folder contains public functions without comments.

Expected outcome:

The skill reports documentation coverage and proposes inline comments for functions that need parameter and return descriptions.

Security Audit

High Risk

v9 • 7/5/2026 Open versioned report

Most static findings are false positives from Markdown examples, generated documentation placeholders, or sample configuration names. The executable slash-command scripts are real shell entry points, and the larger concern is their unpinned npx execution of claude-flow plus default writes to repository documentation files.

Files scanned

3,881

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

slash-command-doc-api.sh:100-103 slash-command-doc-inline.sh:98-102 slash-command-doc-readme.sh:87-91

Unpinned Third-Party Package Execution

The slash-command scripts invoke npx claude-flow@alpha for hooks and memory storage. Running an alpha npm package during documentation generation can download and execute third-party code.

The scripts directly call npx with an external package name in executable paths. This is a clear supply-chain execution risk even though it appears intended for workflow coordination.

Medium

slash-command-doc-readme.sh:93-99 slash-command-doc-readme.sh:167-178 slash-command-doc-api.sh:94-96 slash-command-doc-api.sh:231-233

Documentation Scripts Modify Repository Files by Default

The README and API scripts create or overwrite documentation files in the current project. This can change repository contents without a dry-run default or confirmation prompt.

The cited script paths create directories, copy generated specs, back up README.md, and write README content. These are intended actions but still affect repository state by default.

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

slash-command-doc-api.sh:1

Unix shell invocation

#!/bin/bash

This is an executable Bash entry point that scans project files and writes documentation outputs. Shell automation is expected, but it is still real command-execution behavior for a marketplace skill.

Medium

slash-command-doc-inline.sh:1

Unix shell invocation

#!/bin/bash

Medium

slash-command-doc-readme.sh:1

Unix shell invocation

#!/bin/bash

Risk Factors

⚙️ External commands (180)

🌐 Network access (34)

📁 Filesystem access (45)

🔑 Env variables (5)

PROCESS.md:734 SKILL.md:491 SKILL.md:408 SKILL.md:409 slash-command-doc-readme.sh:465

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/dnyoussef-when-documenting-code-use-doc-generator/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/dnyoussef-when-documenting-code-use-doc-generator/security.svg)](https://skillstore.io/skills/dnyoussef-when-documenting-code-use-doc-generator?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/dnyoussef-when-documenting-code-use-doc-generator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dnyoussef-when-documenting-code-use-doc-generator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/dnyoussef-when-documenting-code-use-doc-generator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

DNYoussef. (2026). when-documenting-code-use-doc-generator security audit report (audit version 9) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/dnyoussef-when-documenting-code-use-doc-generator/audits/9

BibTeX citation

@techreport{dnyoussef-dnyoussef-when-documenting-code-use-doc-generator-2026,
  author = {DNYoussef},
  title = {when-documenting-code-use-doc-generator security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/dnyoussef-when-documenting-code-use-doc-generator/audits/9},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "when-documenting-code-use-doc-generator security audit report (audit version 9)"
version: "1.0.0"
type: report
authors:
  - name: "DNYoussef"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/dnyoussef-when-documenting-code-use-doc-generator/audits/9"
identifiers:
  - type: other
    value: "skillstore:dnyoussef-when-documenting-code-use-doc-generator:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Document a Backend API

Generate OpenAPI-style references, endpoint summaries, authentication notes, and usage examples for a service repository.

Refresh Project Onboarding Docs

Create a README with setup, configuration, testing, contribution, and support sections from repository metadata.

Improve Code Comment Coverage

Identify undocumented functions and create inline comment guidance for supported language styles.

Try These Prompts

Generate Basic Docs

Use this skill to review the current repository and generate basic README and API documentation. Keep the output concise and list files changed.

Create API Reference

Use this skill to document the REST API in this project. Include endpoints, request formats, response summaries, authentication notes, and validation warnings.

Add Inline Comments

Use this skill to find undocumented public functions in src. Add or propose JSDoc, TSDoc, or Python docstrings, and avoid changing business logic.

Build Full Documentation Set

Use this skill to generate README, API reference, architecture notes, inline comment recommendations, and a documentation gap report. Run in dry-run mode when possible and flag risky writes before editing.

Best Practices

Run the skill in a clean branch and review generated files before merging.
Provide the target documentation type, preferred format, and coverage goal.
Keep secrets out of examples and replace placeholders before publishing.

Avoid

Do not run generation scripts against repositories with uncommitted critical changes.
Do not publish generated API details before checking authentication and data exposure.
Do not assume examples are production-ready without validation.