find-untested-sources
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFE
Full Analysis
- Static Code Analysis: The skill uses Roslyn (for C#) and tree-sitter (via
tree-sitter-language-pack) to parse source files and identify declarations and references. These are standard industry tools for static analysis. - Local Execution Scope: The scripts are designed to run locally against a specified repository root. They implement pruning of common build and environment directories (e.g.,
bin,obj,node_modules,.git,.venv) to ensure analysis stays within the intended project scope. - Trusted External Dependencies:
- The C# script uses the
Microsoft.CodeAnalysis.CSharppackage, which is a core component of the .NET compiler platform maintained by Microsoft. - The Python script utilizes
tree-sitter-language-pack, a widely used package for polyglot code parsing. - No Remote Code Execution or Exfiltration: The analysis is purely static (parse-only) and explicitly avoids building the target repository, running its tests, or performing network operations. Results are emitted as local JSON output.
Audit Metadata