mapping-codebases
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation includes a link to an archived release tag on the author's official GitHub repository. The changelog also references a historical fallback mechanism that used
curlto download tree-sitter grammars. - [COMMAND_EXECUTION]: The skill provides migration instructions that include executing a Python script (
treesit.py) residing in a separate skill directory on the local filesystem. - [INDIRECT_PROMPT_INJECTION]: The skill describes functionality for parsing external codebases, which inherently involves an ingestion surface for untrusted source code. 1. Ingestion points: Local files within a repository directory specified by the user. 2. Boundary markers: None described in the deprecation notice. 3. Capability inventory: The replacement tool performs file reads and executes scripts to extract AST data. 4. Sanitization: Not explicitly documented in the migration guidance.
- [NO_CODE]: The current version of this skill (0.9.0) contains only markdown documentation and a changelog; all original scripts and binary parsers have been removed.
Audit Metadata