cpg-analysis
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions to execute a local setup script
~/.claude/install-graph-tools.shwith specific flags (--joern,--codeql). This is used for environment preparation. - [COMMAND_EXECUTION]: The MCP (Model Context Protocol) configuration involves running local commands such as
codeql-mcpwith database arguments, which is necessary for the skill's stated functionality. - [EXTERNAL_DOWNLOADS]: The documentation refers to external installation steps via standard package managers (e.g.,
brew install codeql) and the use of Docker for the Joern backend. These are dependencies for well-known and reputable security analysis tools. - [SAFE]: The skill is designed to ingest and analyze external codebases (untrusted data). While this constitutes an indirect prompt injection surface, it is a fundamental aspect of the skill's primary purpose as a security auditor. The risks are inherent to the task of code analysis and are handled within the context of the user-initiated audit process.
Audit Metadata