codemap
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes arbitrary files within a repository to generate architectural documentation and track changes. This behavior creates a vulnerability surface for indirect prompt injection, where an attacker could place malicious instructions inside the repository's source code or configuration files. If the agent reads these instructions while summarizing or mapping the codebase, it might be coerced into performing unintended actions.
- Ingestion points: The
codemap.mjsscript reads file contents to compute hashes, and theSKILL.mdworkflow requires "Fixer" agents to read code files to write documentation. - Boundary markers: The instructions do not define clear delimiters or use "ignore embedded instructions" directives when the agent processes the untrusted repository content.
- Capability inventory: The agent has the ability to write files to the repository (
.slim/codemap.jsonandcodemap.md) and potentially execute further commands as part of the orchestration workflow. - Sanitization: There is no evidence of sanitization or filtering of the file contents before they are processed by the LLM.
Audit Metadata