gitnexus-cli
Warn
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and executes the 'gitnexus' package from the npm registry using
npxorpnpm dlxif the local runner is absent. - [REMOTE_CODE_EXECUTION]: Instructs the agent to execute code directly from the npm registry via
npx gitnexus analyzeandpnpm dlx gitnexus@latest analyze. - [COMMAND_EXECUTION]: Executes a dynamically generated script
node .gitnexus/run.cjsthat is created in the project directory during the analysis process. - [PROMPT_INJECTION]:
- Ingestion points: Repository source files parsed by the
analyzeandwikicommands (referenced in SKILL.md). - Boundary markers: None identified to prevent malicious instructions within the source code from influencing documentation output.
- Capability inventory: Generates repository documentation (wiki) and context files (CLAUDE.md/AGENTS.md) using an LLM based on source code content.
- Sanitization: No evidence of sanitization or filtering of source code content before it is processed by the LLM.
- [DATA_EXFILTRATION]: The
wiki --gistflag publishes generated repository documentation to a public GitHub Gist, which could lead to accidental exposure of sensitive project information. - [CREDENTIALS_UNSAFE]: Directs the agent to handle and store LLM API keys in
~/.gitnexus/config.jsonfor documentation generation tasks.
Audit Metadata