code-trace
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local shell script (scripts/detect-framework.sh) to identify the project framework by reading the package.json file. This operation is scoped to project identification and does not involve external network requests.
- [PROMPT_INJECTION]: As a code tracing tool, the skill naturally ingests untrusted data (source code) which constitutes a surface for indirect prompt injection.
- Ingestion points: Application source code files are read via Serena MCP tools during the tracing workflows defined in workflows/trace-request.md and workflows/trace-function.md.
- Boundary markers: The skill employs clear structural delimiters defined in references/explanation-style.md, including markdown code blocks and standardized 'Thinking Markers' (e.g., 🤔, 🎯) to distinguish between source code and agent-generated explanations.
- Capability inventory: The skill utilizes Serena MCP tools for file searching (find_symbol), symbol cross-referencing (find_referencing_symbols), and state persistence (write_memory, read_memory).
- Sanitization: The skill displays complete source code without abbreviation in fenced markdown blocks to maintain transparency and context separation.
Audit Metadata