cli-analysis

Pass

Audited by Gen Agent Trust Hub on Jul 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Recommends installing the pyscn package from the Python Package Index (PyPI) using pip install or running it dynamically via uvx.
  • [COMMAND_EXECUTION]: Instructs the agent to execute the pyscn CLI tool for comprehensive code analysis, including complexity, dead code, and dependency cycle detection.
  • [PROMPT_INJECTION]: The skill processes untrusted Python source code and instructs the agent to summarize the results, which introduces a surface for indirect prompt injection.
  • Ingestion points: Reads and analyzes files from user-specified local directories (e.g., src/).
  • Boundary markers: No specific delimiters or instructions are provided to the agent to ignore potentially malicious content embedded in the source code comments or strings being analyzed.
  • Capability inventory: Execution of shell commands via the CLI and reading generated JSON/HTML report files from the .pyscn/reports/ directory.
  • Sanitization: There is no mention of sanitizing or escaping the content extracted from the analysis reports before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 16, 2026, 05:06 AM