roam
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Recommends installing the roam-code package via pip, which is a vendor-owned dependency for the skill's functionality.
- [COMMAND_EXECUTION]: Orchestrates codebase analysis through the roam CLI, including commands that perform read operations on the local codebase and targeted write operations for documentation purposes (e.g., updating CLAUDE.md).
- [INDIRECT_PROMPT_INJECTION]: Analyzes untrusted codebase data. • Ingestion points: Local project files (indexed via roam init). • Boundary markers: Absent. • Capability inventory: Subprocess execution and local file modification commands (SKILL.md). • Sanitization: Data is processed and structured by the roam-code utility.
Audit Metadata