exploring-codebases
Pass
Audited by Gen Agent Trust Hub on May 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
uv pip installto fetch thetree-sitter-language-packfrom the standard Python package registry. This is a well-known tool used for generating abstract syntax trees for code analysis.\n- [COMMAND_EXECUTION]: The skill orchestrates its workflow by executing shell commands to run structural analysis scripts (treesit.py) and feature documentation generators (gather.py). These operations are consistent with the skill's stated purpose of codebase exploration.\n- [PROMPT_INJECTION]: As the skill is designed to analyze external and potentially untrusted repositories, it presents a surface for indirect prompt injection if a codebase contains malicious instructions within its source code, comments, or documentation.\n - Ingestion points: Files in the repository path provided to the analysis commands by the agent or user.\n
- Boundary markers: None; the skill acts as a direct orchestrator for external analysis tools.\n
- Capability inventory: The workflow involves structural inventory, symbol counts, and feature synthesis across the provided directory structure.\n
- Sanitization: None; the skill relies on standard tree-sitter parsers to process code structure.
Audit Metadata