gitnexus-cli

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute various shell commands using npx gitnexus, which triggers the execution of the GitNexus CLI utility.
  • [EXTERNAL_DOWNLOADS]: Use of the npx command results in the retrieval of the gitnexus package from the npm registry if it is not already present locally.
  • [DATA_EXFILTRATION]: The wiki command includes a --gist flag which, if used, publishes the generated repository documentation to a public GitHub Gist. This behavior is a documented feature of the tool for sharing documentation externally.
  • [INDIRECT_PROMPT_INJECTION]: The analyze command parses all source files within a repository to build a knowledge graph and generate context files (CLAUDE.md, AGENTS.md). This process constitutes an ingestion surface where content from untrusted source files is processed into instructions or context for the AI agent.
  • Ingestion points: All source files in the project root processed by npx gitnexus analyze.
  • Boundary markers: None explicitly mentioned in the skill instructions.
  • Capability inventory: Execution of shell commands via npx (as described in SKILL.md).
  • Sanitization: No specific sanitization or filtering of codebase content is described before it is converted into agent context.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 06:16 PM