The Agent Skills Directory

[SAFE]: The skill performs static analysis only and explicitly forbids importing or executing target code. It implements a read-only preflight check for its pinned dependencies (grimp==3.15, jedi==0.20.0) and refuses to automatically install packages via pip.
[COMMAND_EXECUTION]: The skill uses subprocess.run to interact with a locally installed CodeQL CLI. This behavior is restricted to generating a static database using --build-mode=none, which prevents the execution of arbitrary build scripts (like setup.py) in the analyzed repository. These operations are gated by user authorization via the --allow-codeql-write flag.
[DATA_EXPOSURE]: The skill requires an explicit work root for all generated reports and caches, defaulting to the active session's bootstrap directory. This ensures that analysis artifacts and CodeQL databases remain contained within a designated session-local path.

code-mapper-skill