gitnexus-guide

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the user to execute node .gitnexus/run.cjs analyze in the terminal to refresh the codebase index when it becomes stale. This refers to a local script within the project's own directory structure.
  • [DYNAMIC_EXECUTION]: The skill describes a cypher tool that executes raw graph queries against the repository's knowledge graph to perform advanced code intelligence tasks.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external codebase data through various tools and MCP resources, creating a surface for indirect prompt injection.
  • Ingestion points: Codebase metadata and symbol information are retrieved via gitnexus:// URI resources and tool outputs like query and context (SKILL.md).
  • Boundary markers: The documentation does not specify explicit delimiters or "ignore" instructions for the agent when processing repo data.
  • Capability inventory: The skill leverages tools capable of multi-file refactoring (rename), data flow analysis (explain), and graph querying (cypher).
  • Sanitization: No explicit sanitization or validation logic for the ingested repository content is detailed in this guide.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 06:23 AM