codemod-runner
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends the installation of well-known development tools and libraries from official package registries. These include 'libcst' (via pip), 'jscodeshift', '@ast-grep/cli', and 'ts-morph' (via npm). These are standard tools in the software engineering ecosystem for AST-based code transformations.
- [COMMAND_EXECUTION]: Utilizes standard Unix utilities such as 'ripgrep' (rg), 'grep', 'wc', 'split', and 'git' for codebase analysis and management. It also uses language-specific runners like 'npx' and 'uv' to execute transformation scripts locally. The instructions emphasize a manual verification workflow (git diff) to ensure tool output is correct before committing changes.
- [DATA_EXFILTRATION]: No suspicious network operations or unauthorized data access patterns were detected. External references are limited to official documentation and repositories for the recommended transformation tools (e.g., comby.dev, ts-morph.com, github.com/facebook/jscodeshift).
- [PROMPT_INJECTION]: The instructions follow a clear, task-oriented structure without any attempts to override agent behavior or bypass safety constraints.
Audit Metadata