jcodemunch-mcp-code-retrieval
Pass
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
jcodemunch-mcppackage from PyPI viapiporuvx. It also suggests optional dependencies such assentence-transformersandtorchfor semantic search functionality.\n- [COMMAND_EXECUTION]: Installation and configuration steps involve executing shell commands likeuvx jcodemunch-mcpand thejcmCLI helper to integrate the tool with various IDEs and agents.\n- [PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes content from local repositories that may contain adversarial instructions.\n - Ingestion points: Local source code files indexed via the
index_repositorytool inSKILL.md.\n - Boundary markers: The skill does not explicitly define delimiters or warnings to ignore embedded instructions when retrieving code snippets.\n
- Capability inventory: The skill provides access to code implementations and class hierarchies but does not execute the indexed code or perform network operations with the retrieved data.\n
- Sanitization: Code is parsed using tree-sitter AST, which provides a more robust structural representation than raw text, though it does not verify the intent of the retrieved code comments or documentation.
Audit Metadata