security-ownership-map

Pass

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes shell commands such as find, git log, and grep to analyze the repository's file structure and commit history. This is a functional requirement for its purpose of ownership mapping.
  • [DATA_EXFILTRATION]: The skill extracts contributor email addresses from the git history to identify code owners. While this involves processing PII (emails), the data remains within the local project directory (docs/ownership-map/) and no evidence of external transmission was found.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from git logs (commit messages, author names) which could theoretically be manipulated to influence the agent's summary. However, this is a standard risk for any tool processing external repository metadata and is mitigated by the skill's focus on statistical reporting.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 10, 2026, 08:13 AM
Security Audit — agent-trust-hub — security-ownership-map