analyze
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
npx codebase-intelligencewith various flags to extract project structure, hotspots, and dependency metrics for software analysis. - [EXTERNAL_DOWNLOADS]: The skill fetches documentation from the author's GitHub repository at
https://raw.githubusercontent.com/bntvllnt/codebase-intelligence/main/llms.txtand invokes external packages vianpxat runtime. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted user-provided content and file data. \n
- Ingestion points: Target file paths and topic descriptions provided in the analysis command (SKILL.md). \n
- Boundary markers: The prompt template uses a
TARGET: [content]label but lacks robust delimiters or explicit instructions to ignore embedded instructions. \n - Capability inventory: The skill utilizes file system read access and the ability to execute subprocesses via
npx. \n - Sanitization: No explicit input sanitization is described, although agents are instructed to specifically identify misuse and adversarial patterns.
- [DYNAMIC_EXECUTION]: The skill dynamically generates and executes commands using the
codebase-intelligencepackage to produce structured metadata about software projects at runtime.
Audit Metadata