tech-debt-map
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill's operations are limited to reading local codebase files and git history to generate a markdown report. It specifically states it is for diagnosis only and does not change any code.
- [COMMAND_EXECUTION]: The skill uses git log to identify hot spots in the codebase based on commit frequency. This is a legitimate use of a local command for the skill's stated purpose of auditing code churn.
- [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface as it reads untrusted data from the codebase being audited. Ingestion points: Reads files in scope, CONTEXT.md, ADRs, CLAUDE.md, and AGENTS.md. Boundary markers: None identified. Capability inventory: Executes git log, writes files to .scratch/, and proposes invocation of other skills. Sanitization: None described. While the surface exists, the risk is minimal given the diagnostic nature of the output.
Audit Metadata