dkod
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes shell commands such as
claude mcp addandexportto configure the dkod MCP server and authentication tokens. These are used for initial setup and environment configuration. - [EXTERNAL_DOWNLOADS]: Configures and interacts with the dkod MCP server hosted at
https://api.dkod.io/mcp. This external resource is owned by the skill vendor and is required for the parallel execution features. - [PROMPT_INJECTION]: The skill processes untrusted codebase data through tools like
dk_file_readanddk_context, and has the capability to write changes back viadk_file_writeanddk_push. - Ingestion points:
dk_file_readanddk_contexttools (documented in SKILL.md and references/mcp-workflow.md). - Boundary markers: Absent; no explicit instruction delimiters are mentioned for processing external code.
- Capability inventory:
dk_file_write,dk_merge,dk_push, anddk_submitallow for codebase modification and PR creation (documented in SKILL.md and references/mcp-workflow.md). - Sanitization: Absent; the skill performs AST-level structural analysis which does not validate against natural language instructions embedded in code comments or strings.
Audit Metadata