graph-code
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to interact with a code graph. It utilizes a local Python script located at
.claude/scripts/code_graphto perform tasks like building the graph, tracing code flow, and analyzing the impact of changes (blast radius). - [DYNAMIC_EXECUTION]: Inline JavaScript is executed using
node -eto check project configurations and manage environment setup. These scripts interface with local utility files such as.claude/hooks/lib/graph-utils.cjsto handle dependency verification and project-specific settings. - [EXTERNAL_DOWNLOADS]: The skill mentions the installation of required Python packages including
tree-sitter,tree-sitter-language-pack, andnetworkx. These are standard libraries used for parsing source code and performing graph analysis, typically installed viapipor automated project hooks. - [INDIRECT_PROMPT_INJECTION]: The skill parses project source code to construct a knowledge graph, which introduces an indirect prompt injection surface. The instructions attempt to mitigate this by requiring structured output and evidence-based claims, but the processing of arbitrary code files is the primary ingestion point.
Audit Metadata