codebase-inspection
Pass
Audited by Gen Agent Trust Hub on Apr 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the 'pygount' package from the standard Python package registry using pip.
- [COMMAND_EXECUTION]: The skill executes shell commands to run 'pygount' and 'sort' for analyzing files in a local directory.
- [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection by processing untrusted data from local repositories. Ingestion points: local file system (SKILL.md). Boundary markers: absent. Capability inventory: subprocess execution of pygount and sort. Sanitization: absent. While data is ingested, the risk is minimal as the tool acts as a parser for metrics rather than an executor of file content.
Audit Metadata