lsp-index-engineer
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides legitimate instructions for orchestrating language servers and building code intelligence graphs. The behaviors described (LSP capability negotiation, symbol extraction, graph construction) are consistent with the stated purpose.
- [EXTERNAL_DOWNLOADS]: The skill references standard global installations of well-known language servers (e.g.,
typescript-language-server,intelephense,gopls,rust-analyzer,pyright) using official package managers. These are established services in the developer ecosystem and do not pose an inherent security risk in this context. - [COMMAND_EXECUTION]: Provides example shell commands for verifying LSP server connectivity via stdio. These are informative examples for development and do not execute malicious code.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process source code from external files to build semantic indexes. This represents a standard ingestion surface for development tools; while it should be handled with caution in production environments (e.g., sanitizing symbol names), the skill itself does not contain malicious injection patterns.
Audit Metadata