qodo-codebase-wisdom
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
qodoCLI for codebase searching and implements path resolution logic to handle restricted agent environments safely by resolving the binary location in the user's home directory. - [EXTERNAL_DOWNLOADS]: Mentions official vendor installers from
https://get.qodo.aiand correctly advises against unsafe practices like piping remote scripts directly into the shell. - [REMOTE_CODE_EXECUTION]: Incorporates
qodo updatefor tool maintenance, which is a vendor-provided function gated by compatibility checks and explicit user approval. - [PRIVILEGE_ESCALATION]: Provides a diagnostic pathway for authentication issues that is gated by explicit user approval and limited to a single, read-only command outside the sandbox.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external codebase and pull request data (ingestion points). It mitigates injection risks by enforcing boundary markers (mandatory citations), restricting capabilities to read-only CLI operations, and requiring confirmation of the tool contract.
Audit Metadata