workflow
Pass
Audited by Gen Agent Trust Hub on Apr 28, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches documentation and capability references for the
codebase-intelligencetool from the author's official GitHub repository (github.com/bntvllnt/codebase-intelligence). This is a neutral operation used to ensure the agent has up-to-date instructions for vendor-provided tooling. - [COMMAND_EXECUTION]: Executes
npx codebase-intelligenceto perform structural analysis, dependency mapping, and hotspot detection on TypeScript projects. This command utilizes a vendor resource from the skill author and is consistent with the primary purpose of the skill. - [DATA_EXPOSURE]: Scans project-level and user-level configuration files (e.g.,
CLAUDE.md,.cursorrules,AGENTS.md) to discover and apply project-specific coding standards. While these files are read to provide context, the skill never exfiltrates their content, and updates to these files require explicit user approval. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted codebase content to generate reviews, focus tasks, and bug fix summaries. This represents an attack surface common to development tools. The risk is mitigated by the skill's structured data processing and the requirement for human verification of suggested actions.
Audit Metadata