codacy-cloud-cli
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions include the installation of the
@codacy/codacy-cloud-clipackage from the NPM registry. This package is the primary tool for the skill's functionality and is provided by the identified vendor. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process potentially untrusted data from external sources, including repository issue titles, security finding descriptions, and pull request content.
- Ingestion points: Data is fetched via commands such as
codacy issues,codacy findings, andcodacy pull-requestas described inSKILL.md. - Boundary markers: None identified. The instructions do not specify the use of delimiters or 'ignore' instructions for the data retrieved from Codacy.
- Capability inventory: The agent has the ability to execute shell commands using the
codacyCLI and read the resulting output. - Sanitization: Not specified. The skill does not explicitly mention sanitization or validation of the text content returned by the CLI before it is processed by the agent.
Audit Metadata