security-ownership-map
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands such as
find,git log, andgrepto analyze the repository's file structure and commit history. This is a functional requirement for its purpose of ownership mapping. - [DATA_EXFILTRATION]: The skill extracts contributor email addresses from the git history to identify code owners. While this involves processing PII (emails), the data remains within the local project directory (
docs/ownership-map/) and no evidence of external transmission was found. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from git logs (commit messages, author names) which could theoretically be manipulated to influence the agent's summary. However, this is a standard risk for any tool processing external repository metadata and is mitigated by the skill's focus on statistical reporting.
Audit Metadata