skills/peachest/skills/codegraph-dev/Gen Agent Trust Hub

codegraph-dev

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute various CLI commands for the codegraph tool (e.g., init, sync, status, query, explore, impact). These commands are used to interact with a local code index and are part of the intended functionality.
  • [PERSISTENCE]: The skill provides instructions for setting up a git hook in .git/hooks/post-commit. This hook executes codegraph sync -q automatically to ensure the code index remains synchronized with the repository's state.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the local codebase through CodeGraph's analysis tools. This creates an attack surface where malicious content within the source code could potentially influence the agent's behavior when it reviews the extracted context.
  • Ingestion points: Codebase content is read and analyzed via codegraph explore, codegraph context, and codegraph node commands.
  • Boundary markers: The instructions do not specify the use of delimiters or specific warnings to ignore embedded instructions in the ingested code.
  • Capability inventory: The skill utilizes shell command execution for the codegraph CLI and modifies the local repository's git hooks.
  • Sanitization: There is no explicit sanitization step described; the skill relies on the CodeGraph tool's output and the agent's internal safety protocols.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 10:43 AM