derive-codebase-context
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill requires the agent to write a custom generator script (generate.mjs) using Node.js built-ins and subsequently execute it to produce repository context artifacts. Creating and running code generated at runtime is a risk factor as the logic could be manipulated by the environment or contain errors. \n- [REMOTE_CODE_EXECUTION]: The instructions recommend running Serena via uvx, which fetches and executes packages from remote registries. This introduces a dependency on the integrity of third-party external code executed within the agent's environment. \n- [INDIRECT_PROMPT_INJECTION]: The skill parses the local repository tree to generate documentation and indices. This ingestion of codebase content creates a surface where maliciously crafted files could influence the agent's summary or the logic of the generated artifacts. \n
- Ingestion points: Local repository files accessed through git and Node.js file system built-ins (referenced in SKILL.md and references/onboarding.md). \n
- Boundary markers: The skill specifies the use of 'generated, do not edit' headers for identification but lacks explicit instructions for sanitization of the data processed from the tree. \n
- Capability inventory: Access to Bash for command execution (git, node, uvx) and Write/Edit permissions for file modifications (referenced in SKILL.md). \n
- Sanitization: No explicit sanitization or validation of the codebase content is performed before it is summarized into markdown artifacts. \n- [EXTERNAL_DOWNLOADS]: The skill involves the installation of development dependencies such as dependency-cruiser and the use of SCIP indexers like scip-typescript. While these are established development tools, they represent the introduction of external code into the project environment. \n- [COMMAND_EXECUTION]: The workflow relies on shell commands including git, node, and filesystem operations like cp and rm for 'mutation testing.' This procedure involves the deliberate introduction of forbidden patterns to verify gate failures, which could lead to temporary unsafe states if not properly reverted.
Audit Metadata