ripple
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard CLI tools such as
grep,find, andmadge(vianpx) to perform static analysis and dependency tracing on the codebase. These operations are limited to the intended analytical scope.- [EXTERNAL_DOWNLOADS]: The skill references the execution ofmadgeusingnpx, which involves downloading the tool from the public npm registry if it is not already available locally. It also provides reference links to GitHub and OWASP documentation.- [INDIRECT_PROMPT_INJECTION]: Because the skill processes external codebase data, it is theoretically susceptible to indirect prompt injection where malicious instructions could be embedded in the analyzed files. This is a low-level risk factor inherent to code analysis tools.
Audit Metadata