project-decomposition

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFE
Full Analysis
  • Local Project Structural Analysis: The skill utilizes a custom Python script, scripts/decompose.py, to analyze the local project root. This process involves walking the directory tree to identify modules, count lines of code, and map dependencies. These operations are performed entirely within the local environment without making external network requests.- Secure Dependency Management: The provided script is designed to run using only Python's standard library. It does not import or require any third-party packages, which minimizes the risk of supply chain vulnerabilities or unverifiable dependencies.- Sanitized File Processing: The script includes logic to ignore sensitive or irrelevant directories like .git and node_modules. It also specifically filters for recognized source code extensions while ignoring binary files, ensuring that the analysis remains focused on the intended source material.- Safe Data Parsing: When processing specific configuration files, such as Odoo manifests, the script uses ast.literal_eval. This is a secure method for evaluating string literals into Python objects, protecting against potential code execution risks that would be present with standard eval() functions.- Defined Operational Boundaries: The instructions provide clear constraints on the skill's scope, explicitly stating that it is not intended for running tests, builds, or semantic architecture analysis, thereby maintaining a narrow and predictable execution profile.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 08:01 AM
Security Audit — agent-trust-hub — project-decomposition