graph-code

Pass

Audited by Gen Agent Trust Hub on Nov 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands to interact with a code graph. It utilizes a local Python script located at .claude/scripts/code_graph to perform tasks like building the graph, tracing code flow, and analyzing the impact of changes (blast radius).
  • [DYNAMIC_EXECUTION]: Inline JavaScript is executed using node -e to check project configurations and manage environment setup. These scripts interface with local utility files such as .claude/hooks/lib/graph-utils.cjs to handle dependency verification and project-specific settings.
  • [EXTERNAL_DOWNLOADS]: The skill mentions the installation of required Python packages including tree-sitter, tree-sitter-language-pack, and networkx. These are standard libraries used for parsing source code and performing graph analysis, typically installed via pip or automated project hooks.
  • [INDIRECT_PROMPT_INJECTION]: The skill parses project source code to construct a knowledge graph, which introduces an indirect prompt injection surface. The instructions attempt to mitigate this by requiring structured output and evidence-based claims, but the processing of arbitrary code files is the primary ingestion point.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 4, 2026, 10:12 AM