cli-analysis
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Recommends installing the
pyscnpackage from the Python Package Index (PyPI) usingpip installor running it dynamically viauvx. - [COMMAND_EXECUTION]: Instructs the agent to execute the
pyscnCLI tool for comprehensive code analysis, including complexity, dead code, and dependency cycle detection. - [PROMPT_INJECTION]: The skill processes untrusted Python source code and instructs the agent to summarize the results, which introduces a surface for indirect prompt injection.
- Ingestion points: Reads and analyzes files from user-specified local directories (e.g.,
src/). - Boundary markers: No specific delimiters or instructions are provided to the agent to ignore potentially malicious content embedded in the source code comments or strings being analyzed.
- Capability inventory: Execution of shell commands via the CLI and reading generated JSON/HTML report files from the
.pyscn/reports/directory. - Sanitization: There is no mention of sanitizing or escaping the content extracted from the analysis reports before it is processed by the agent.
Audit Metadata