codacy-analysis-cli
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands through the codacy-analysis CLI to perform static analysis, repository initialization, and authentication management.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the @codacy/analysis-cli package via NPM and additional tools through the --install-dependencies flag. These resources are vendor-provided or established industry tools.
- [DATA_EXFILTRATION]: The skill accesses the ~/.codacy/ directory to store and manage authentication credentials and log files, which is consistent with its role as a cross-repository analysis tool.
- [INDIRECT_PROMPT_INJECTION]: The skill analysis of untrusted repository content introduces a surface for indirect prompt injection. 1. Ingestion points: Repository files and code analyzed by the CLI. 2. Boundary markers: None provided to distinguish analysis output from data instructions. 3. Capability inventory: Shell command execution and file system access. 4. Sanitization: No explicit output filtering or sanitization is described.
Audit Metadata