gitnexus-plan

Pass

Audited by Gen Agent Trust Hub on Aug 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: Spawns the system git binary to retrieve repository status, HEAD commits, and file content for evidence provenance. It also spawns python3 to execute a hardcoded script for atomic, race-condition-safe file movements using the renameat2 syscall on Linux systems.
  • [EXTERNAL_DOWNLOADS]: References the use of npx gitnexus as a fallback mechanism to invoke the core GitNexus analyzer if it is not already installed locally.
  • [SAFE]: Implements a robust 'evidence provenance' system that cryptographically hashes (SHA-256) repository file content to pin the state of the codebase during the planning phase, ensuring consistency without external data exfiltration.
  • [SAFE]: The helper script evidence-provenance.mjs includes defensive programming practices such as strict path normalization, no-follow symlink checks, and ownership validation for executable binaries to prevent common local exploitation vectors.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 13, 2026, 01:27 AM
Security Audit — agent-trust-hub — gitnexus-plan