gitnexus-taint-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a technical reference guide for the GitNexus codebase, specifically focusing on its program analysis subsystem (CFG, reaching definitions, and taint analysis). It describes the internal logic for both intra-procedural and inter-procedural data flow analysis.
- [SAFE]: No malicious patterns such as prompt injection, data exfiltration, or obfuscated code were detected. The instructions are designed to assist a developer in understanding, extending, or debugging the analyzer.
- [SAFE]: The commands referenced in the validation checklist (e.g.,
tsc,vitest,node scripts/build.js, andnode bench/cfg/measure.mjs) are standard development tools and local project-specific scripts used for verifying code changes in a development environment. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and review source code, which constitutes an ingestion point for untrusted data. While the agent has capabilities to execute local build and test scripts, this behavior is central to the skill's primary purpose of code review and development assistance. No exploitable vulnerabilities or missing boundary markers were identified that would escalate this beyond the inherent risk of processing project files.
Audit Metadata