mapping-codebases

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill documentation includes a link to an archived release tag on the author's official GitHub repository. The changelog also references a historical fallback mechanism that used curl to download tree-sitter grammars.
  • [COMMAND_EXECUTION]: The skill provides migration instructions that include executing a Python script (treesit.py) residing in a separate skill directory on the local filesystem.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes functionality for parsing external codebases, which inherently involves an ingestion surface for untrusted source code. 1. Ingestion points: Local files within a repository directory specified by the user. 2. Boundary markers: None described in the deprecation notice. 3. Capability inventory: The replacement tool performs file reads and executes scripts to extract AST data. 4. Sanitization: Not explicitly documented in the migration guidance.
  • [NO_CODE]: The current version of this skill (0.9.0) contains only markdown documentation and a changelog; all original scripts and binary parsers have been removed.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 06:44 PM