octocode-engineer
Pass
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses a bootstrap mechanism in 'src/common/ensure-deps.ts' to automatically detect the local package manager and install required runtime dependencies (such as typescript, tree-sitter, and ast-grep) from the public NPM registry.
- [COMMAND_EXECUTION]: The analysis engine executes shell commands using 'node:child_process' to identify files affected by git changes and to run package manager installation commands for self-maintenance.
- [SAFE]: The instructions in 'SKILL.md' enforce a safety-first operating contract, requiring the agent to stop at 'hard gates' before performing destructive actions or changing public contracts, and mandating that all analytical hypotheses be validated with multiple local evidence sources.
Audit Metadata