ripple
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: The skill operates purely as a set of logical instructions for the AI agent to evaluate code dependencies and risks. It does not include scripts, binaries, or external dependencies.
- [NO_CODE]: No executable scripts (Python, Node.js, Shell) are included in the skill. The logic is entirely contained within the markdown instructions.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided descriptions of code changes and analyzes project files. While this represents a data ingestion surface, the risk is evaluated as safe because the skill is explicitly designed for analysis only and does not perform write operations or system commands.
- Ingestion points: User request describing changes; Project file contents during dependency tracing (SKILL.md).
- Boundary markers: None explicitly defined for untrusted data.
- Capability inventory: None. The skill frontmatter and body restrict behavior to analysis only ("Does not write code").
- Sanitization: None required for text-based analysis.
Audit Metadata