ts-codemap
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local TypeScript build and update scripts using the
tsxruntime. It also manages its own dependencies by runningnpm installwithin the skill directory. - [EXTERNAL_DOWNLOADS]: Fetches standard packages such as
ts-morphandtsxfrom the official NPM registry. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by extracting JSDoc comments from the target codebase and summarizing them in
MAP.md, which is intended for consumption by other AI agents. - Ingestion points: Source files in the target repository are read by
scripts/lib.tsusingfs.readFileSync. - Boundary markers: The generated
MAP.mdlacks delimiters or instructions for consuming agents to ignore instructions embedded within the extracted comments. - Capability inventory: The skill possesses filesystem write permissions to generate the index files.
- Sanitization: Extracted JSDoc strings are not sanitized or escaped before being included in the map.
Audit Metadata