linguistic-semantic-algorithms

Pass

Audited by Gen Agent Trust Hub on Jul 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.check_output across several reference files to interact with local system binaries.
  • Evidence: Calls to git (in mine-change-coupling.md, mine-bus-factor.md, mine-hotspots-churn-complexity.md, mine-bug-fix-density.md, local-history-prior-localization.md, mine-codebase-aging.md, mine-commit-topic-modeling.md, sim-doc-code-alignment.md).
  • Evidence: Calls to gh (GitHub CLI) in sim-cross-pr-feature-mapping.md to fetch pull request metadata.
  • Evidence: Calls to gumtree in clone-ast-gumtree.md for AST differencing.
  • [EXTERNAL_DOWNLOADS]: The instructions and code examples recommend the installation and use of a wide array of third-party Python packages for specialized analysis.
  • Evidence: gensim (topic modeling), networkx (graph analysis), scikit-learn (VSM/TF-IDF), transformers (CodeBERT/embeddings), spacy (NLP), nltk (Porter stemming), pydivsufsort (suffix arrays), complexipy (cognitive complexity), radon (cyclomatic complexity), sentence_transformers (embeddings), datasketch (MinHash/LSH), simhash (fingerprinting), apted (tree edit distance), rapidfuzz (string matching), rank-bm25 (IR ranking).
  • [DATA_EXFILTRATION]: The mine-bus-factor algorithm processes personally identifiable information (PII) by extracting developer email addresses from the local version control system.
  • Evidence: references/mine-bus-factor.md uses git blame --line-porcelain to collect author-mail fields for authorship concentration metrics.
  • [SAFE]: No evidence of prompt injection, code obfuscation, or persistence mechanisms was found. The skill is highly technical and provides accurate references to canonical academic papers and established software engineering metrics.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 6, 2026, 09:03 PM
Security Audit — agent-trust-hub — linguistic-semantic-algorithms