gitnexus-cli
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute various shell commands using
npx gitnexus, which triggers the execution of the GitNexus CLI utility. - [EXTERNAL_DOWNLOADS]: Use of the
npxcommand results in the retrieval of thegitnexuspackage from the npm registry if it is not already present locally. - [DATA_EXFILTRATION]: The
wikicommand includes a--gistflag which, if used, publishes the generated repository documentation to a public GitHub Gist. This behavior is a documented feature of the tool for sharing documentation externally. - [INDIRECT_PROMPT_INJECTION]: The
analyzecommand parses all source files within a repository to build a knowledge graph and generate context files (CLAUDE.md,AGENTS.md). This process constitutes an ingestion surface where content from untrusted source files is processed into instructions or context for the AI agent. - Ingestion points: All source files in the project root processed by
npx gitnexus analyze. - Boundary markers: None explicitly mentioned in the skill instructions.
- Capability inventory: Execution of shell commands via
npx(as described in SKILL.md). - Sanitization: No specific sanitization or filtering of codebase content is described before it is converted into agent context.
Audit Metadata