gitnexus-plan
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Spawns the system
gitbinary to retrieve repository status, HEAD commits, and file content for evidence provenance. It also spawnspython3to execute a hardcoded script for atomic, race-condition-safe file movements using therenameat2syscall on Linux systems. - [EXTERNAL_DOWNLOADS]: References the use of
npx gitnexusas a fallback mechanism to invoke the core GitNexus analyzer if it is not already installed locally. - [SAFE]: Implements a robust 'evidence provenance' system that cryptographically hashes (SHA-256) repository file content to pin the state of the codebase during the planning phase, ensuring consistency without external data exfiltration.
- [SAFE]: The helper script
evidence-provenance.mjsincludes defensive programming practices such as strict path normalization, no-follow symlink checks, and ownership validation for executable binaries to prevent common local exploitation vectors.
Audit Metadata