nerd-fast
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/symbol_index.pyexecutes local CLI tools such asgitandctagsto facilitate file enumeration and symbol extraction. These executions are performed using thesubprocessmodule with list-based arguments, which prevents shell injection vulnerabilities. The script interacts only with the local repository and standard system binaries. - [EXTERNAL_DOWNLOADS]: Instructions within
SKILL.mddefine a protocol for the agent to check for the presence ofUniversal Ctags. If the dependency is missing, the agent is instructed to request explicit user authorization before initiating an installation. This ensures that no external software is downloaded or installed without informed user consent. - [DATA_EXFILTRATION]: The skill builds a local index of symbols to optimize navigation. This process involves reading file metadata and symbol definitions, which are then stored in a persistent SQLite database located in the user's standard local cache directory (e.g.,
~/.cache/nerd/). There are no network operations detected that would exfiltrate this repository data to a remote server.
Audit Metadata