seed-component-map
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill operates exclusively as a discovery tool for local repository structures. It uses built-in modules (
node:fsandnode:path) to read directory contents and file metadata. It does not perform any network operations, write to the filesystem, or execute external scripts. - [INDIRECT_PROMPT_INJECTION]: The tool ingests untrusted data by reading the content of source files within the repository to extract export patterns and registry configuration.
- Ingestion points: The
mapSeedComponentfunction inscripts/component-map.tsreads file content usingreadFileto build an export graph and check registry manifests. - Boundary markers: The skill outputs a structured JSON object to stdout, separating the found paths into logical buckets (rootage, headless, implementations, etc.).
- Capability inventory: The skill's capabilities are restricted to read-only access of specific subdirectories within the repository root. It does not possess write or execution capabilities.
- Sanitization: Component name inputs are strictly validated for length (max 120 chars) and character set (alphanumeric, spaces, underscores, and hyphens). File content is processed using fixed regular expressions for pattern matching rather than dynamic evaluation.
Audit Metadata