understand
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project data from README files and source code. It implements mandatory mitigation by instructing subagents to treat this data as untrusted and to ignore any embedded directives or prompt-like strings.
- [COMMAND_EXECUTION]: To perform codebase indexing, the skill executes a suite of bundled Node.js and Python utility scripts. These scripts use deterministic logic to scan files, compute semantic batches, and merge analysis results locally.
- [DYNAMIC_EXECUTION]: The skill dynamically generates minimal Node.js scripts for graph validation and fingerprinting during the final phases of analysis. These are transient operations used to ensure the integrity of the generated data.
- [REMOTE_CODE_EXECUTION]: During initial setup, the skill may invoke 'pnpm install' to ensure its own internal dependencies are present. This is a standard project initialization step for local developer tools.
- [DATA_EXPOSURE]: The skill reads the project's source code and configuration to build its analysis. All data remains within the project's local data directory ('.ua' or '.understand-anything') and no evidence of external data exfiltration was detected.
Audit Metadata