skills/kenlck/skills/codemap/Gen Agent Trust Hub

codemap

Pass

Audited by Gen Agent Trust Hub on Nov 4, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted source code files to generate a structural map (MAP.md) intended for consumption by the AI agent, which represents an indirect prompt injection surface.
  • Ingestion points: The skill recursively walks the target repository and reads the contents of source files (.py, .java, .go, .rs) using fs.readFileSync in scripts/lib.ts.
  • Boundary markers: The generated MAP.md utilizes standard Markdown formatting (headers, lists, and code blocks) to structure the extracted symbol information.
  • Capability inventory: The skill is limited to local filesystem read/write operations within the target directory; it lacks network access, shell execution, or privilege escalation capabilities.
  • Sanitization: The skill uses the Node.js path module to normalize and resolve relative paths within the target directory.
  • [DYNAMIC_EXECUTION]: The skill dynamically loads and executes binary WASM grammars at runtime to facilitate code parsing.
  • In scripts/lib.ts, the skill uses web-tree-sitter to load language-specific WASM files resolved from the tree-sitter-wasms package based on the detected file extensions.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 4, 2026, 12:00 PM