epistemic-mapper
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data from the codebase and project documentation to identify knowledge gaps, which introduces a potential for indirect prompt injection. Ingestion points: all files within the repository's source and documentation directories. Boundary markers: use of a strict Quadrant Test classification flowchart and mandatory compliance with a specific JSON schema for extraction output. Capability inventory: the Python merge script reads local JSON findings and writes to a markdown file. Sanitization: the merge script collapses whitespaces and newlines to prevent content from breaking the markdown structure.
- [COMMAND_EXECUTION]: The skill executes a local Python script, scripts/merge_epistemic_map.py, to consolidate extracted data. The script relies exclusively on the Python standard library and implements safety checks such as absolute path enforcement to prevent unintended file operations.
Audit Metadata